includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

Updated mediawiki packages fix security vulnerabilities :

Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword, whereby a user can be logged into an attackers account without being aware of it, allowing the attacker to track the user's activity (CVE-2014-2665).

XSS vulnerability in MediaWiki before 1.22.6, where if the default sort key is set to a string containing a script, the script will be executed when the page is viewed using the info action.

MediaWiki has been updated to version 1.22.6, fixing this and other issues.

- (bug 62497) SECURITY: Add CSRF token on     Special:ChangePassword.

    - (bug 62467) Set a title for the context during import       on the cli.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In versions older than 1.22.5, 1.21.8, and 1.19.14, WikiMedia contains a flaw in Special:ChangePassword, due to its implementation of the password reset action. An attacker could leverage the lack of explicit confirmation, unique tokens, or multi-step process, to induce a victim to reset their password via a specially crafted link.

According to its version number, the instance of MediaWiki running on the remote host is affected by a cross-site request forgery vulnerability.

A flaw exists with Special:ChangePassword within the includes/specials/SpecialChangePassword.php script where HTTP requests do not require explicit confirmation, a unique token, and/or multiple steps performing sensitive actions. This allows a context-dependent attacker to reset a user's password.

Nessus has not tested for this issue but has instead relied on the application's self-reported version number.

The remote Debian host is missing a security update. It is, therefore, affected by multiple vulnerabilities in MediaWiki :

  - A cross-site scripting (XSS) vulnerability exists due to     a failure to validate input before returning it to the     user. An unauthenticated, remote attacker can exploit     this, via specially crafted SVG files, to execute     arbitrary script code in the user's browser session.
    (CVE-2013-2031)

  - A flaw exists in the password blocking mechanism due to     two different tools being used to block password change     requests, these being Special:PasswordReset and     Special:ChangePassword, either of which may be bypassed     by the method the other prevents. A remote attacker can     exploit this issue to change passwords. (CVE-2013-2032)

  - Multiple flaws exist in Sanitizer::checkCss due to the     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit these to     bypass the blacklist. (CVE-2013-4567, CVE-2013-4568)

  - A flaw exists due to multiple users being granted the     same session ID within HTTP headers. A remote attacker     can exploit this to authenticate as another random     user. (CVE-2013-4572)

  - A cross-site scripting (XSS) vulnerability exists in the     /includes/libs/XmlTypeCheck.php script due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XSL file, to execute arbitrary script code in     the user's browser session. (CVE-2013-6452)

  - A flaw exists in the /includes/upload/UploadBase.php     script due to a failure to apply SVG sanitization when     XML files are read as invalid. An unauthenticated,     remote attacker can exploit this to upload non-sanitized     XML files, resulting in an unspecified impact.
    (CVE-2013-6453)

  - A stored cross-site (XSS) scripting vulnerability exists     in the /includes/Sanitizer.php script due to a failure     to properly validate the '-o-link' attribute before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in the user's     browser session. (CVE-2013-6454)

  - A flaw exists in the log API within the     /includes/api/ApiQueryLogEvents.php script that allows     an unauthenticated, remote attacker to disclose     potentially sensitive information regarding deleted     pages. (CVE-2013-6472)

  - Multiple flaws exist in the PdfHandler_body.php,     DjVu.php, Bitmap.php, and ImageHandler.php scripts when     DjVu or PDF file upload support is enabled due to     improper sanitization of user-supplied input. An     authenticated, remote attacker can exploit these, via     the use of shell metacharacters, to execute execute     arbitrary shell commands. (CVE-2014-1610)

  - A cross-site request forgery (XSRF) vulnerability exists     in the includes/specials/SpecialChangePassword.php     script due to a failure to properly handle a correctly     authenticated but unintended login attempt. An     unauthenticated, remote attacker, by convincing a user     to follow a specially crafted link, can exploit this to     reset the user's password. (CVE-2014-2665)

ID	Name	Product	Family	Severity
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
73934	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:083)	Nessus	Mandriva Local Security Checks	medium
73426	Fedora 19 : mediawiki-1.21.8-1.fc19 (2014-4511)	Nessus	Fedora Local Security Checks	medium
73425	Fedora 20 : mediawiki-1.21.8-1.fc20 (2014-4478)	Nessus	Fedora Local Security Checks	medium
8181	MediaWiki Password Reset Cross-site Request Forgery Vulnerability	Nessus Network Monitor	CGI	low
73305	MediaWiki < 1.19.14 / 1.21.8 / 1.22.5 ChangePassword XSRF	Nessus	CGI abuses	medium
73256	Debian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-2665

high

Tenable Plugins

critical

medium

medium

medium

low

medium

high