MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.

According to its version number, the instance of MediaWiki running on the remote host is affected by multiple security vulnerabilities :

  - A stored cross-site scripting (HTML injection)     vulnerability exists because the application fails to     sufficiently sanitize user-supplied input submitted to     the 'File:' tag of a non-existing image through     comments. (CVE-2012-4377)

  - Multiple DOM-based cross-site scripting vulnerabilities     exist because the application fails to sufficiently     sanitize user-supplied input to the 'uselang' parameter     and JavaScript gadgets on various language Wikipedias.     (CVE-2012-4378)

  - A cross-site request forgery (XSRF) vulnerability     exists because the application fails to properly     validate requests when X-Frame-Options headers are     used. (CVE-2012-4379)

  - A security-bypass vulnerability exists because the     application fails to prevent the account creation for IP     addresses blocked with the 'GlobalBlocking' extension.
    (CVE-2012-4380)

  - A security-bypass vulnerability exists because the     application fails to prevent the use of old passwords in     the external authentication system for non-existing     accounts. (CVE-2012-4381)

  - An information disclosure occurs when an admin attempts     to block a user who has already been blocked. This     discloses the block reason to the second admin,     regardless of the admin's privileges. (CVE-2012-4382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MediaWiki reports :

(Bug 39700) Wikipedia administrator Writ Keeper discovered a stored XSS (HTML injection) vulnerability. This was possible due to the handling of link text on File: links for nonexistent files. MediaWiki 1.16 and later is affected.

(Bug 39180) User Fomafix reported several DOM-based XSS vulnerabilities, made possible by a combination of loose filtering of the uselang parameter, and JavaScript gadgets on various language Wikipedias.

(Bug 39180) During internal review, it was discovered that CSRF tokens, available via the api, were not protected with X-Frame-Options headers. This could lead to a CSRF vulnerability if the API response is embedded in an external website using using an iframe.

(Bug 39824) During internal review, it was discovered extensions were not always allowed to prevent the account creation action. This allowed users blocked by the GlobalBlocking extension to create accounts.

(Bug 39184) During internal review, it was discovered that password data was always saved to the local MediaWiki database even if authentication was handled by an extension, such as LDAP. This could allow a compromised MediaWiki installation to leak information about user's LDAP passwords. Additionally, in situations when an authentication plugin returned false in its strict function, this would allow old passwords to be used for accounts that did not exist in the external system, indefinitely.

(Bug 39823) During internal review, it was discovered that metadata about blocks, hidden by a user with suppression rights, was visible to administrators.

ID	Name	Product	Family	Type	Severity
62358	MediaWiki < 1.18.5 / 1.19.2 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	high
61765	FreeBSD : mediawiki -- multiple vulnerabilities (7c0fecd6-f42f-11e1-b17b-000c2977ec30)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2012-4382

medium

Tenable Plugins

high

high