Detections
Analytics
MediaWiki < 1.19.22 / 1.22.14 / 1.23.7 Multiple Vulnerabilities
high Nessus Plugin ID 80121
Language:
Synopsis
The remote web server contains an application that is affected by multiple vulnerabilities.Description
According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities :- An input validation error exists related to handling previews of wikitext that allows cross-site scripting attacks. (CVE-2014-9276)
- An input validation error exists related to flash policy mangling, API clients, and 'format=php' that allows cross-site scripting. (CVE-2014-9277)
- An error exists related to 'content model' editing that allows a remote, unprivileged attacker to modify a user's 'common.js' file. (Bug 70901)
- An error exists related to deleting an entry. The 'DELETED_ACTION' and the action 'revdeleted' allows information disclosure via log files. (Bug 72222)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.19.22 / 1.22.14 / 1.23.7 or later.See Also
http://www.nessus.org/u?7796737d
https://www.mediawiki.org/wiki/Release_notes/1.19#MediaWiki_1.19.22
https://www.mediawiki.org/wiki/Release_notes/1.22#MediaWiki_1.22.14
http://www.mediawiki.org/wiki/Release_notes/1.23#MediaWiki_1.23.7
Plugin Details
Severity: High
ID: 80121
File Name: mediawiki_1_23_7.nasl
Version: 1.10
Type: remote
Family: CGI abuses
Published: 12/19/2014
Updated: 6/5/2024
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2014-9277
Vulnerability Information
CPE: cpe:/a:mediawiki:mediawiki
Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/MediaWiki
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No known exploits are available
Patch Publication Date: 11/27/2014
Vulnerability Publication Date: 11/26/2014
Reference Information
CVE: CVE-2014-9276, CVE-2014-9277
BID: 71473