The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.

The version of MediaWiki installed is 1.19.x earlier than 1.19.20, 1.22.x earlier than 1.22.12, or 1.23.x earlier than 1.23.5. Therefore, it is affected by the following XSS vulnerabilities :

 - A flaw exists that allows a XSS attack. This flaw exists because the 'includes/OutputPage.php' script does not restrict JavaScript code embedded within CSS content before returning it to users. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2013-7444)
 - A flaw exists because the 'includes/OutputPage.php' script does not restrict JavaScript code embedded within CSS content before returning it to users. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2014-7295)

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

Updated mediawiki packages fix security vulnerability :

MediaWiki before 1.23.4 is vulnerable to cross-site scripting due to JavaScript injection via CSS in uploaded SVG files (CVE-2014-7199).

MediaWiki before 1.23.5 is vulnerable to cross-site scripting due to JavaScript injection via user-specificed CSS in certain special pages (CVE-2014-7295).

- CVE-2014-7295 (bug 70672) SECURITY: OutputPage: Remove     separation of css and js module allowance.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version number, the MediaWiki application running on the remote host is affected by an input validation error in the 'includes/OutputPage.php' script related to JavaScript in CSS content.
This can be exploited to conduct cross-site scripting (XSS) attacks.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

*CVE-2014-7295 (bug 70672) SECURITY: OutputPage: Remove separation of css and js module allowance.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was reported that MediaWiki, a website engine for collaborative work, allowed to load user-created CSS on pages where user-created JavaScript is not allowed. A wiki user could be tricked into performing actions by manipulating the interface from CSS, or JavaScript code being executed from CSS, on security-wise sensitive pages like Special:Preferences and Special:UserLogin. This update removes the separation of CSS and JavaScript module allowance.

ID	Name	Product	Family	Severity
9474	MediaWiki < 1.19.20 / 1.22.12 / 1.23.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
78614	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:198)	Nessus	Mandriva Local Security Checks	medium
78402	Fedora 20 : mediawiki-1.23.5-1.fc20 (2014-12263)	Nessus	Fedora Local Security Checks	low
78401	Fedora 19 : mediawiki-1.23.5-1.fc19 (2014-12262)	Nessus	Fedora Local Security Checks	low
78109	MediaWiki < 1.19.20 / 1.22.12 / 1.23.5 'includes/OutputPage.php' XSS	Nessus	CGI abuses : XSS	low
78103	Fedora 21 : mediawiki-1.23.5-1.fc21 (2014-12155)	Nessus	Fedora Local Security Checks	low
78047	Debian DSA-3046-1 : mediawiki - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2014-7295

medium

Tenable Plugins

low

critical

medium

low

low

low

low

low