Security Update for MediaWiki
Summary
DSA-2891-1: mediawiki - security update. Affects mediawiki versions < 1:1.19.14+dfsg-0+deb7u1. Fixed in 1:1.19.14+dfsg-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a popular wiki engine used by numerous websites, including Wikipedia. It allows users to collaboratively create and edit content. However, several vulnerabilities have been discovered in MediaWiki, which could potentially be exploited by attackers to execute malicious code, inject JavaScript, perform cross-site scripting attacks, and more.
Vulnerability Detail
The vulnerabilities identified in MediaWiki include:
- Cross-site scripting attack via valid UTF-7 encoded sequences in an SVG file.
- Incomplete blacklist in the CSS sanitizer function, allowing the injection of JavaScript.
- Incorrect cache headers set when a user is autocreated, potentially exposing session cookies to other users.
- Uploading SVG files with external stylesheets, leading to XSS when an XSL is used to include JavaScript.
- Bypassing of SVG sanitization when the XML is considered invalid.
- Failure to filter -o-link attributes in CSS sanitization, enabling JavaScript execution in Opera 12.
- Displaying information about deleted pages in certain APIs and user interfaces.
- Remote code execution vulnerability when file upload support for DjVu or PDF files is enabled.
- Cross-site request forgery in the login form, allowing an attacker to log in as a victim.
How To Fix
Minimum fixed version
1:1.19.14+dfsg-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is essential to apply the recommended fixes by upgrading the affected packages.
Conclusion
MediaWiki users should promptly upgrade their packages to address these vulnerabilities. Failure to do so may expose their websites to potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki →
FAQ
MediaWiki is a wiki engine used by websites like Wikipedia to enable collaborative content creation and editing.
These vulnerabilities can be exploited by attackers to execute malicious code, inject JavaScript, perform cross-site scripting attacks, and more.
No specific workarounds are mentioned for these vulnerabilities. It is crucial to upgrade the affected packages.
The potential consequences include unauthorized code execution, data manipulation, and unauthorized access to user sessions.
To fix these vulnerabilities, upgrade the MediaWiki packages to the recommended versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
