includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.

The remote host is affected by the vulnerability described in GLSA-201310-21 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, perform       man-in-the-middle attacks, obtain sensitive information or perform       cross-site scripting attacks.
  Workaround :

    There is no known workaround at this time.

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities :

  - The full installation path is disclosed in an error     message when an invalid language is specified in the     ResourceLoader. (CVE-2013-4301)

  - Multiple cross-site request forgery vulnerabilities     exist in the API modules accessed through JSONP.
    (CVE-2013-4302)

  - A cross-site scripting vulnerability exists because     input submitted to the property name is not properly     sanitized. (CVE-2013-4303)

Additionally, the following extensions contain vulnerabilities but are not enabled or installed by default (unless otherwise noted) :

  - Authentication can be bypassed in the CentralAuth     extension by manipulating the 'centralauth_User' cookie.
    (CVE-2013-4304)

  - The SyntaxHighlight GeSHi extension is affected by a     cross-site scripting vulnerability because user input is     not properly sanitized when submitted to the     'example.php' script. This extension is installed but     not enabled by default on MediaWiki 1.21.x.
    (CVE-2013-4305)

  - The CheckUser extension is affected by a cross-site     request forgery vulnerability because it does not     properly validate HTTP requests. (CVE-2013-4306)

  - The Wikibase extension is affected by a cross-site     scripting vulnerability because it does not properly     escape the labels in the 'In other languages' section of     entity view. (CVE-2013-4307)

  - The LiquidThreads extensions is affected by a cross-site     scripting vulnerability because it does not properly     sanitize user input submitted to the LQT thread subject.
    (CVE-2013-4308)

Note that Nessus has not tested for these issues but has instead relied on the application's self-reported version number.

- SECURITY: Fix extension detection with 2 .'s

    - SECURITY: Support for the 'gettoken' parameter to       action=block and action=unblock, deprecated since       1.20, has been removed.

    - SECURITY: Sanitize ResourceLoader exception messages

    - Purge upstream caches when deleting file assets.

    - Unit test suite now runs the AutoLoader tests. Also       fixed the autoloading entry for the       PageORMTableForTesting class though it had no impact.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- SECURITY: Sanitize ResourceLoader exception messages

    - SECURITY: Token-getting functions will fail when using       jsonp callbacks.

    - SECURITY: Fix extension detection with 2 .'s

    - Allow a string other than '*' as condition for       DatabaseBase::delete()

    - Purge upstream caches when deleting file assets.

    - jquery.tablesorter: Add missing dependency on       jquery.mwExtension

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in mediawiki :

Full path disclosure in MediaWiki before 1.20.7, when an invalid language is specified in ResourceLoader (CVE-2013-4301).

Several API modules in MediaWiki before 1.20.7 allowed anti-CSRF tokens to be accessed via JSONP (CVE-2013-4302).

An issue with the MediaWiki API in MediaWiki before 1.20.7 where an invalid property name could be used for XSS with older versions of Internet Explorer (CVE-2013-4303).

Several unspecified security issues were fixed with the 1.20.6 version. This replaces the MediaWiki 1.16.5 version, which has been EOL upstream for quite some time now, that was shipped with MBS 1.

MediaWiki removed the Math extension for the 1.18 release, but it is now available separately. It has been packaged in the mediawiki-math package.

The mediawiki-graphviz and mediawiki-ldapauthentication packages have also been updated to work with the new MediaWiki packages.

The updated packages provides a solution to these issues.

ID	Name	Product	Family	Severity
70677	GLSA-201310-21 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
70293	MediaWiki < 1.19.8 / 1.20.7 / 1.21.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
70050	Fedora 20 : mediawiki-1.21.2-1.fc20 (2013-15937)	Nessus	Fedora Local Security Checks	medium
70029	Fedora 18 : mediawiki-1.19.8-1.fc18 (2013-15994)	Nessus	Fedora Local Security Checks	medium
70028	Fedora 19 : mediawiki-1.21.2-1.fc19 (2013-15984)	Nessus	Fedora Local Security Checks	medium
69918	Mandriva Linux Security Advisory : mediawiki (MDVSA-2013:235)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-4301

medium

Tenable Plugins

high

high

medium

medium

medium

medium