Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."

The remote host is affected by the vulnerability described in GLSA-201206-09 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in mediawiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    MediaWiki allows remote attackers to bypass authentication, to perform       imports from any wgImportSources wiki via a crafted POST request, to       conduct cross-site scripting (XSS) attacks or obtain sensitive       information, to inject arbitrary web script or HTML, to conduct       clickjacking attacks, to execute arbitrary PHP code, to inject arbitrary       web script or HTML, to bypass intended access restrictions and to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

This update brings mediawiki to version 1.16.4, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings mediawiki to version 1.16.2, which is the latest stable release at the moment, but currently also the only supported and recommended release by the mediawiki developer community.

Further changes :

  - some simple wiki management functionality was added :

    - mw-createinstance <path> creates a wiki instance under       <path>, which is autoupgraded upon package updates.

  - any wiki path entered in /etc/mediawiki/instances will     be autoupgraded upon package updates.

  - /var/www/wiki is entered into this list automatically,     but you can remove it if you don't want this instance to     be autoupgraded.

  - opensearch and suggestions are enabled by default

    - several bug fixes (see changelog).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

There is a cross-site scripting vulnerability in this installation of MediaWiki that may allow an attacker to execute arbitrary script code in the browser of an unsuspecting user.  Such script code could steal authentication credentials and be used to launch other attacks.

This version of MediaWiki also contains a local file inclusion vulnerability that is exploitable when running Microsoft Windows, but this plugin did not test for that vulnerability.

Medawiki reports :

An arbitrary script inclusion vulnerability was discovered. The vulnerability only allows execution of files with names ending in '.php' which are already present in the local filesystem. Only servers running Microsoft Windows and possibly Novell Netware are affected.
Despite these mitigating factors, all users are advised to upgrade, since there is a risk of complete server compromise. MediaWiki 1.8.0 and later is affected.

Security researcher mghack discovered a CSS injection vulnerability.
For Internet Explorer and similar browsers, this is equivalent to an XSS vulnerability, that is to say, it allows the compromise of wiki user accounts. For other browsers, it allows private data such as IP addresses and browsing patterns to be sent to a malicious external web server. It affects all versions of MediaWiki. All users are advised to upgrade.

ID	Name	Product	Family	Severity
59647	GLSA-201206-09 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53609	Fedora 14 : mediawiki-1.16.4-58.fc14 (2011-5812)	Nessus	Fedora Local Security Checks	medium
53608	Fedora 13 : mediawiki-1.16.4-58.fc13 (2011-5807)	Nessus	Fedora Local Security Checks	medium
53567	Fedora 15 : mediawiki-1.16.4-58.fc15 (2011-5848)	Nessus	Fedora Local Security Checks	medium
53521	Fedora 15 : mediawiki-1.16.4-57.fc15 (2011-5495)	Nessus	Fedora Local Security Checks	medium
51998	MediaWiki CSS Comments XSS	Nessus	CGI abuses : XSS	medium
51915	FreeBSD : mediawiki -- multiple vulnerabilities (8d04cfbd-344d-11e0-8669-0025222482c5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2011-0047

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium