Detections
Analytics
MediaWiki 1.19.x < 1.19.6 / 1.20.x < 1.20.5 Multiple Vulnerabilities
medium Nessus Plugin ID 66390
Language:
Synopsis
The remote web server contains a PHP application that is affected by multiple vulnerabilities.Description
According to its version number, the instance of MediaWiki running on the remote host is affected by multiple security vulnerabilities :- A flaw exists because the application fails to validate input passed via uploaded SVG files before returning it to the user. This allows a remote attacker to conduct cross-site scripting (XSS) attacks. (CVE-2013-2031)
- A flaw exists that allows an attacker to bypass the password change blocking mechanism. (CVE-2013-2032)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.19.6 / 1.20.5 or later.See Also
http://www.nessus.org/u?f67370c9
https://www.mediawiki.org/wiki/Release_notes/1.19#MediaWiki_1.19.6
https://www.mediawiki.org/wiki/Release_notes/1.20#MediaWiki_1.20.5
Plugin Details
Severity: Medium
ID: 66390
File Name: mediawiki_1_19_6.nasl
Version: 1.13
Type: remote
Family: CGI abuses
Published: 5/13/2013
Updated: 6/5/2024
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2013-2032
Vulnerability Information
CPE: cpe:/a:mediawiki:mediawiki
Required KB Items: Settings/ParanoidReport, installed_sw/MediaWiki, www/PHP
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No known exploits are available
Patch Publication Date: 4/30/2013
Vulnerability Publication Date: 4/30/2013
Reference Information
CVE: CVE-2013-2031, CVE-2013-2032