Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.

The version of MediaWiki installed is 1.23.x earlier than 1.23.7 and is affected by multiple vulnerabilities :

 - A flaw exists that allows a reflected cross-site scripting (XSS) attack. This flaw exists because 'Special:ExpandTemplates' does not validate input to the 'wpInput' parameter before rendering it in raw HTML and returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2014-9276)
 - A flaw in the 'wfMangleFlashPolicy()' function in the 'OutputHandler.php' script is triggered as API output that contains 'cross-domain-policy' becomes corrupted when being handled by the aforementioned function. This may allow a remote attacker to more easily bypass intended cross-domain-policy restrictions. (CVE-2014-9277)

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities :

  - An input validation error exists related to handling     previews of wikitext that allows cross-site scripting     attacks. (CVE-2014-9276)

  - An input validation error exists related to flash policy     mangling, API clients, and 'format=php' that allows     cross-site scripting. (CVE-2014-9277)

  - An error exists related to 'content model' editing that     allows a remote, unprivileged attacker to modify a     user's 'common.js' file. (Bug 70901)

  - An error exists related to deleting an entry. The     'DELETED_ACTION' and the action 'revdeleted' allows     information disclosure via log files. (Bug 72222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated mediawiki packages fix security vulnerabilies :

In MediaWiki before 1.23.7, a missing CSRF check could allow reflected XSS on wikis that allow raw HTML (CVE-2014-9276).

MediaWiki's mangling, in MediaWiki before 1.23.7, could allow an article editor to inject code into API consumers that blindly unserialize PHP representations of the page from the API (CVE-2014-9277).

This update provides MediaWiki 1.23.7, which fixes these security issues and other bugs.

ID	Name	Product	Family	Severity
9476	MediaWiki < 1.23.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80121	MediaWiki < 1.19.22 / 1.22.14 / 1.23.7 Multiple Vulnerabilities	Nessus	CGI abuses	high
79986	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:241)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2014-9276

medium

Tenable Plugins

high

critical

high

high