The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.

The version of MediaWiki installed is 1.23.x earlier than 1.23.12, 1.24.x earlier than 1.24.5, or 1.25.x earlier than 1.25.4, or 1.26.x earlier than 1.26.1. Therefore, it is affected by multiple vulnerabilities :

 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'includes/Setup.php' script does not ensure that the 'wgArticlePath' variable is set to an absolute path. This may allow a remote attacker to create a page with a specially crafted name referenced by another page, allowing the execution of arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8622)
 - A flaw in the 'User::matchEditToken()' function within 'includes/user/User.php' is due to the program failing to use constant-time string comparisons. This may allow a remote attacker to conduct a timing attack in order to determine tokens. (CVE-2015-8623, 2015-8624)
 - A flaw exists within the 'CurlHttpRequest::execute()' function inside of 'includes/HttpFunctions.php' and the 'MultiHttpClient::getCurlHandle()' function inside of 'includes/libs/MultiHttpClient.php'. The issue is triggered as the functions do not properly handle POST parameters starting with an '@' character. This may allow a remote attacker to potentially disclose the contents of arbitrary files. (CVE-2015-8625)
 - A flaw within the 'passwordFactory::generateRandomPasswordString()' function in 'includes/password/PasswordFactory.php' is triggered as the 'User::randomPassword()' method generates passwords without honoring configured policies for minimum password lengths. This may result in users having weaker passwords than intended. (CVE-2015-8626)
 - A flaw exists within the 'includes/utils/IP.php' script that is due to the application failing to properly parse IP addresses. This may cause an administrative user to accidentally block IP addresses not intended to be blocked. (CVE-2015-8627)
 - A flaw is triggered when handling a redirect from multiple pages. With a specially crafted web page, a context-dependent attacker can disclose the username for a given user. (CVE-2015-8628)

MediaWiki reports :

(T117899) SECURITY: $wgArticlePath can no longer be set to relative paths that do not begin with a slash. This enabled trivial XSS attacks. Configuration values such as 'http://my.wiki.com/wiki/$1' are fine, as are '/wiki/$1'. A value such as '$1' or 'wiki/$1' is not and will now throw an error.

(T119309) SECURITY: Use hash_compare() for edit token comparison.

(T118032) SECURITY: Don't allow cURL to interpret POST parameters starting with '@' as file uploads.

(T115522) SECURITY: Passwords generated by User::randomPassword() can no longer be shorter than $wgMinimalPasswordLength.

(T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could result in improper blocks being issued.

(T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions and related pages no longer use HTTP redirects and are now redirected by MediaWiki.

ID	Name	Product	Family	Severity
9473	MediaWiki < 1.23.12 / 1.24.5 / 1.25.4 / 1.26.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low
87616	FreeBSD : mediawiki -- multiple vulnerabilities (f36bbd66-aa44-11e5-8f5c-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2015-8628

medium

Tenable Plugins

low

critical