Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.

According to its version number, the instance of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability.
An input-validation flaw exists related to 'Special:PasswordReset'.
This allows a remote attacker to execute arbitrary code within the server and browser trust relationship.

Nessus has not tested for this issue but has instead relied on the application's self-reported version number.

Omer Iqbal discovered that MediaWiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack.

Updated mediawiki packages fix security vulnerability :

XSS vulnerability in MediaWiki before 1.22.7, due to usernames on Special:PasswordReset being parsed as wikitext. The username on Special:PasswordReset can be supplied by anyone and will be parsed with wgRawHtml enabled. Since Special:PasswordReset is whitelisted by default on private wikis, this could potentially lead to an XSS crossing a privilege boundary (CVE-2014-3966).

ID	Name	Product	Family	Severity
76148	MediaWiki < 1.19.16 / 1.21.10 / 1.22.7 'Special:PasswordReset' XSS	Nessus	CGI abuses : XSS	low
74498	Debian DSA-2957-1 : mediawiki - security update	Nessus	Debian Local Security Checks	low
74452	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:119)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2014-3966

medium

Tenable Plugins

low

low

low