Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext.

mediawiki reports :

security fixes :

T128209: Reflected File Download from api.php. Reported by Abdullah Hussam.

T165846: BotPasswords doesn't throttle login attempts.

T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password.

T178451: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping.

T176247: It's possible to mangle HTML via raw message parameter expansion.

T125163: id attribute on headlines allow raw.

T124404: language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition.

T119158: Language converter: unsafe attribute injection via glossary rules.

T180488: api.log contains passwords in plaintext wasn't correctly fixed.

T180231: composer.json has require-dev versions of PHPUnit with known security issues. Reported by Tom Hutchison.

- (T109140) (T122209) Special:UserLogin and Special:Search     allow redirect to interwiki links. (CVE-2017-0363,     CVE-2017-0364)

  - (T144845) XSS in SearchHighlighter::highlightText() when     $wgAdvancedSearchHighlighting is true. (CVE-2017-0365)

  - (T125177) API parameters may now be marked as     'sensitive' to keep their values out of the logs.
    (CVE-2017-0361)

  - (T150044) 'Mark all pages visited' on the watchlist now     requires a CSRF token. (CVE-2017-0362)

  - (T156184) Escape content model/format url parameter in     message. (CVE-2017-0368)

  - (T151735) SVG filter evasion using default attribute     values in DTD declaration. (CVE-2017-0366)

  - (T48143) Spam blacklist ineffective on encoded URLs     inside file inclusion syntax's link parameter.
    (CVE-2017-0370)

  - (T108138) Sysops can undelete pages, although the page     is protected against it. (CVE-2017-0369)

The following only affects 1.27 and above and is not included in the 1.23 upgrade :

  - (T161453) LocalisationCache will no longer use the     temporary directory in its fallback chain when trying to     work out where to write the cache. (CVE-2017-0367)

The following fix is for the SyntaxHighlight extension :

  - (T158689) Parameters injection in SyntaxHighlight     results in multiple vulnerabilities. (CVE-2017-0372)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MediaWiki installed is 1.23.x prior to 1.23.16, 1.27.x prior to 1.27.2, or 1.28.x prior to 1.28.1, and is affected by multiple vulnerabilities :

 - A flaw exists that is due to the program storing sensitive parameter information in 'api.log' in plaintext. This may allow a local attacker to gain access to password information. (CVE-2017-0361)
 - A flaw exists as HTTP requests to 'includes/specials/SpecialWatchlist.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF/XSRF) attack causing the victim to mark all pages as visited in a watchlist. (CVE-2017-0362)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'highlightText()' function in 'includes/search/SearchHighlighter.php' does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0365)
 - A flaw exists that allows a stored XSS attack. This flaw exists because the program does not validate input when handling uploaded SVG files before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0366)
 - A flaw exists in the 'includes/cache/localisation/LocalisationCache.php' script that is triggered as the 'LocalisationCache' will fall back to the insecure temporary directory when determining the location to write the cache, potentially disclosing sensitive information to a local attacker. (CVE-2017-0367)
 - A flaw exists in the 'includes/EditPage.php' script that is triggered as input passed via the message parser is not properly sanitized when using the rawHTML mode. This may allow a remote attacker to potentially inject arbitrary HTML content. (CVE-2017-0368)
 - A flaw exists that may allow an authenticated remote attacker to potentially undelete a page without the appropriate authorizations. (CVE-2017-0369)
 - A flaw exists in the 'includes/parser/Parser.php' script that is triggered as the spam blacklist features does not properly function on encoded URLs in the file inclusion syntax's link parameter. This may allow a remote attacker to bypass blacklist protection mechanisms. (CVE-2017-0370)
 - A flaw exists that allows a stored XSS attack. This flaw exists because the 'SyntaxHighlight_GeSHi.class.php' script does not validate input to the 'start' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0372)

ID	Name	Product	Family	Severity
104693	FreeBSD : mediawiki -- multiple vulnerabilities (298829e2-ccce-11e7-92e4-000c29649f92)	Nessus	FreeBSD Local Security Checks	critical
99408	Fedora 25 : mediawiki (2017-3fb95ed01f)	Nessus	Fedora Local Security Checks	critical
700053	MediaWiki 1.23.x < 1.23.16 / 1.27.x < 1.27.2 / 1.28.x < 1.28.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2017-0361

high

Tenable Plugins

critical

critical

medium