MediaWiki - User-Created CSS Allows Unauthorized Actions
Summary
DSA-3046-1: mediawiki - security update. Affects mediawiki versions < 1:1.19.20+dfsg-0+deb7u1. Fixed in 1:1.19.20+dfsg-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a website engine designed for collaborative work. It allows users to create and edit content on a wiki platform. MediaWiki is widely used for various purposes, including hosting Wikipedia. This vulnerability affects MediaWiki versions prior to 1.19.20+dfsg-0+deb7u1 on Debian 7 (wheezy).
Vulnerability Detail
The vulnerability in MediaWiki allows user-created CSS to be loaded on pages where user-created JavaScript is not allowed. This enables a malicious user to manipulate the interface and perform unauthorized actions on sensitive pages such as Special:Preferences and Special:UserLogin. The separation between CSS and JavaScript module allowance is removed in the updated version of MediaWiki.
How To Fix
Minimum fixed version
1:1.19.20+dfsg-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
MediaWiki versions prior to 1.19.20+dfsg-0+deb7u1 on Debian 7 (wheezy) are vulnerable to a security issue that allows unauthorized actions through user-created CSS. Upgrading to version 1.19.20+dfsg-0+deb7u1 or later is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki →
FAQ
MediaWiki is a website engine used for collaborative work, allowing users to create and edit content on a wiki platform.
Versions of MediaWiki prior to 1.19.20+dfsg-0+deb7u1 on Debian 7 (wheezy) are affected.
This vulnerability allows a malicious user to perform unauthorized actions on sensitive pages, potentially compromising user accounts and system security.
To fix this vulnerability, upgrade your MediaWiki packages to version 1.19.20+dfsg-0+deb7u1 or later.
No workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
