Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

Updated mediawiki packages fix security vulnerability :

MediaWiki before 1.23.4 is vulnerable to cross-site scripting due to JavaScript injection via CSS in uploaded SVG files (CVE-2014-7199).

MediaWiki before 1.23.5 is vulnerable to cross-site scripting due to JavaScript injection via user-specificed CSS in certain special pages (CVE-2014-7295).

According to its version number, the MediaWiki application running on the remote host is affected by an input validation error related to SVG file upload handling and CSS content filtering that can lead to cross-site scripting (XSS) attacks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- (bug 69008) SECURITY: Enhance CSS filtering in SVG     files. Filter <style> elements; normalize style elements     and attributes before filtering; add checks for     attributes that contain css; add unit tests for html5sec     and reported bugs.

    - (bug 65998) Make MySQLi work with non-standard socket.

    - (bug 66986) GlobalVarConfig shouldn't throw exceptions       for null-valued config settings.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that MediaWiki, a wiki engine, did not sufficiently filter CSS in uploaded SVG files, allowing for cross site scripting.

ID	Name	Product	Family	Severity
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
78614	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:198)	Nessus	Mandriva Local Security Checks	medium
78063	MediaWiki < 1.19.19 / 1.22.11 / 1.23.4 SVG Upload and CSS XSS	Nessus	CGI abuses : XSS	medium
78055	Fedora 20 : mediawiki-1.23.4-1.fc20 (2014-11727)	Nessus	Fedora Local Security Checks	medium
78054	Fedora 19 : mediawiki-1.23.4-1.fc19 (2014-11582)	Nessus	Fedora Local Security Checks	medium
78001	Fedora 21 : mediawiki-1.23.4-1.fc21 (2014-11717)	Nessus	Fedora Local Security Checks	medium
77919	Debian DSA-3036-1 : mediawiki - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-7199

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium