The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

The remote Debian host is missing a security update. It is, therefore, affected by multiple vulnerabilities in MediaWiki :

  - A cross-site scripting (XSS) vulnerability exists due to     a failure to validate input before returning it to the     user. An unauthenticated, remote attacker can exploit     this, via specially crafted SVG files, to execute     arbitrary script code in the user's browser session.
    (CVE-2013-2031)

  - A flaw exists in the password blocking mechanism due to     two different tools being used to block password change     requests, these being Special:PasswordReset and     Special:ChangePassword, either of which may be bypassed     by the method the other prevents. A remote attacker can     exploit this issue to change passwords. (CVE-2013-2032)

  - Multiple flaws exist in Sanitizer::checkCss due to the     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit these to     bypass the blacklist. (CVE-2013-4567, CVE-2013-4568)

  - A flaw exists due to multiple users being granted the     same session ID within HTTP headers. A remote attacker     can exploit this to authenticate as another random     user. (CVE-2013-4572)

  - A cross-site scripting (XSS) vulnerability exists in the     /includes/libs/XmlTypeCheck.php script due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XSL file, to execute arbitrary script code in     the user's browser session. (CVE-2013-6452)

  - A flaw exists in the /includes/upload/UploadBase.php     script due to a failure to apply SVG sanitization when     XML files are read as invalid. An unauthenticated,     remote attacker can exploit this to upload non-sanitized     XML files, resulting in an unspecified impact.
    (CVE-2013-6453)

  - A stored cross-site (XSS) scripting vulnerability exists     in the /includes/Sanitizer.php script due to a failure     to properly validate the '-o-link' attribute before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in the user's     browser session. (CVE-2013-6454)

  - A flaw exists in the log API within the     /includes/api/ApiQueryLogEvents.php script that allows     an unauthenticated, remote attacker to disclose     potentially sensitive information regarding deleted     pages. (CVE-2013-6472)

  - Multiple flaws exist in the PdfHandler_body.php,     DjVu.php, Bitmap.php, and ImageHandler.php scripts when     DjVu or PDF file upload support is enabled due to     improper sanitization of user-supplied input. An     authenticated, remote attacker can exploit these, via     the use of shell metacharacters, to execute execute     arbitrary shell commands. (CVE-2014-1610)

  - A cross-site request forgery (XSRF) vulnerability exists     in the includes/specials/SpecialChangePassword.php     script due to a failure to properly handle a correctly     authenticated but unintended login attempt. An     unauthenticated, remote attacker, by convincing a user     to follow a specially crafted link, can exploit this to     reset the user's password. (CVE-2014-2665)

Updated mediawiki packages fix security vulnerabilities :

Kevin Israel (Wikipedia user PleaseStand) identified and reported two vectors for injecting JavaScript in CSS that bypassed MediaWiki's blacklist (CVE-2013-4567, CVE-2013-4568).

Internal review while debugging a site issue discovered that MediaWiki and the CentralNotice extension were incorrectly setting cache headers when a user was autocreated, causing the user's session cookies to be cached, and returned to other users (CVE-2013-4572).

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities :

  - Input validation errors exist that allow cross-site     scripting attacks. (CVE-2013-4567, CVE-2013-4568)

  - An error exists related to session IDs and HTTP headers     that allows an information disclosure. (CVE-2013-4572)

Additionally, the following extensions contain vulnerabilities but are not enabled or installed by default (unless otherwise noted) : 

  - An input validation error exists related to the     'CentralAuth' extension that allows cross-site request     forgery (CSRF) attacks. (CVE-2012-5394)

  - An error exists in the 'CleanChanges' extension that     allows an information disclosure related to     'revision-deleted' IP addresses. (CVE-2013-4569)

  - An input validation error exists in the     'ZeroRatedMobileAccess' extension that allows cross-site     scripting attacks. (CVE-2013-4573)

Note that Nessus has not tested for these issues but has instead relied on the application's self-reported version number.

- Kevin Israel (Wikipedia user PleaseStand) identified and     reported two vectors for injecting JavaScript in CSS     that bypassed MediaWiki's blacklist (CVE-2013-4567,     CVE-2013-4568).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=55332>

  - Internal review while debugging a site issue discovered     that MediaWiki and the CentralNotice extension were     incorrectly setting cache headers when a user was     autocreated, causing the user's session cookies to be     cached, and returned to other users (CVE-2013-4572).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=53032>

Additionally, the following extensions have been updated to fix security issues :

  - CleanChanges: MediaWiki steward Teles reported that     revision-deleted IP's are not correctly hidden when this     extension is used (CVE-2013-4569).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=54294>

  - ZeroRatedMobileAccess: Tomasz Chlebowski reported an XSS     vulnerability (CVE-2013-4573).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=55991>

  - CentralAuth: MediaWiki developer Platonides reported a     login CSRF in CentralAuth (CVE-2012-5394).
    <https://bugzilla.wikimedia.org/show_bug.cgi?id=40747>

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
73256	Debian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities	Nessus	Debian Local Security Checks	high
71510	Mandriva Linux Security Advisory : mediawiki (MDVSA-2013:290)	Nessus	Mandriva Local Security Checks	medium
71500	MediaWiki < 1.19.9 / 1.20.8 / 1.21.3 Multiple Vulnerabilities	Nessus	CGI abuses	medium
71407	Fedora 20 : mediawiki-1.21.3-1.fc20 (2013-22047)	Nessus	Fedora Local Security Checks	medium
71150	Fedora 18 : mediawiki-1.19.9-1.fc18 (2013-21874)	Nessus	Fedora Local Security Checks	medium
71149	Fedora 19 : mediawiki-1.21.3-1.fc19 (2013-21856)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4572

high

Tenable Plugins

high

medium

medium

medium

medium

medium