JSONP Injection and Clickjacking Vulnerabilities in MediaWiki
Summary
DSA-3011-1: mediawiki - security update. Affects mediawiki versions < 1:1.19.18+dfsg-0+deb7u1. Fixed in 1:1.19.18+dfsg-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a website engine designed for collaborative work. It powers popular websites like Wikipedia and provides a platform for creating and editing content. MediaWiki is vulnerable to two security issues: JSONP injection in Flash and clickjacking between OutputPage and ParserOutput.
Vulnerability Detail
The JSONP injection vulnerability (CVE-2014-5241) allows an attacker to inject malicious code into Flash files, potentially leading to unauthorized access or data theft. The clickjacking vulnerability (CVE-2014-5243) enables an attacker to trick users into performing unintended actions by overlaying deceptive content on top of legitimate pages. These vulnerabilities have been addressed in MediaWiki version 1.19.18.
How To Fix
Minimum fixed version
1:1.19.18+dfsg-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
MediaWiki versions prior to 1.19.18 are vulnerable to JSONP injection and clickjacking. To ensure the security of your MediaWiki installation, it is crucial to upgrade to version 1.19.18 or later. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for mediawiki →
FAQ
JSONP injection is a technique that allows an attacker to inject malicious code into Flash files, potentially leading to unauthorized access or data theft.
Clickjacking is a technique where an attacker tricks users into performing unintended actions by overlaying deceptive content on top of legitimate pages.
You can use Vulert's playground (https://vulert.com/scanner) to check if your MediaWiki installation is affected by these vulnerabilities. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities.
No, the recommended solution is to upgrade to MediaWiki version 1.19.18 or later.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3011-1 (https://security-tracker.debian.org/tracker/CVE-2014-5241) and (https://security-tracker.debian.org/tracker/CVE-2014-5243).
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
