An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7e9d6015f6 advisory.

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x     before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
    (CVE-2023-36675)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before     1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the     thumb parameter (aka Manualthumb) of the File syntax. (CVE-2023-36674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d8ae3c122e advisory.

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x     before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
    (CVE-2023-36675)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before     1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the     thumb parameter (aka Manualthumb) of the File syntax. (CVE-2023-36674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1fcaba0998 advisory.

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x     before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
    (CVE-2023-36675)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before     1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the     thumb parameter (aka Manualthumb) of the File syntax. (CVE-2023-36674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5447 advisory.

  - An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x     before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header. (CVE-2023-29141)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x     before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
    (CVE-2023-36675)

  - Mediawiki reports: (T335203, CVE-2023-29197) Upgrade guzzlehttp/psr7 to >= 1.9.1/2.4.5. (T335612,     CVE-2023-36674) Manualthumb bypasses badFile lookup. (T332889, CVE-2023-36675) XSS in BlockLogFormatter     due to unsafe message             use. (CVE-2023-36674)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 95dad123-180e-11ee-86ba-080027eda32c advisory.

  - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to     improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values.
    While the specification states that \r\n\r\n is used to terminate the header list, many servers in the     wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue     has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users     are advised to upgrade. (CVE-2023-29197)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before     1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the     thumb parameter (aka Manualthumb) of the File syntax. (CVE-2023-36674)

  - An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x     before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
    (CVE-2023-36675)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185230	Fedora 39 : mediawiki (2023-7e9d6015f6)	Nessus	Fedora Local Security Checks	medium
180461	Fedora 37 : mediawiki (2023-d8ae3c122e)	Nessus	Fedora Local Security Checks	medium
180459	Fedora 38 : mediawiki (2023-1fcaba0998)	Nessus	Fedora Local Security Checks	medium
178014	Debian DSA-5447-1 : mediawiki - security update	Nessus	Debian Local Security Checks	critical
177883	FreeBSD : mediawiki -- multiple vulnerabilities (95dad123-180e-11ee-86ba-080027eda32c)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2023-36675

medium

Tenable Plugins

medium

medium

medium

critical

high