Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 6 & 7: 2019-0279 Moderate: MediaWiki CSRF & XSS Issues

mageia
Calendar Grey September 15, 2019
Dist Mageia Esm H88
Mageia releases enhancements for mediawiki packages, addressing security threats such as CSRF and XSS vulnerabilities.
Updated mediawiki packages fix security vulnerabilities: Potential XSS in jQuery (CVE-2019-11358)

Summary

Updated mediawiki packages fix security vulnerabilities:
Potential XSS in jQuery (CVE-2019-11358).
An account can be logged out without using a token (CSRF) (CVE-2019-12466).
A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them (CVE-2019-12467).
Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover (CVE-2019-12468).
Exposed suppressed username or log in Special:EditTags (CVE-2019-12469).
Exposed suppressed log in RevisionDelete page (CVE-2019-12470).
Loading user JavaScript from a non-existent account allows anyone to create the account, and XSS the users' loading that script (CVE-2019-12471).
It is possible to bypass the limits on IP range blocks (`$wgBlockCIDRLimit`) by using the API (CVE-2019-12472).
Passing invalid titles to the API could cause a DoS by querying the entire `watchlist` table (CVE-2019-12473).
Privileged API responses that include whether a recent...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=25273

- https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/ELKVIU2EXCMNKB5MZTF75SLGRZ4GP6P7/

- https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/RFDCW4XUTZW6FR3NFG377LIVERKCJEZI/

- https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/LN52HLZYLQIDKED7HUJJS52SB5SLGR46/

- https://www.cve.org/CVERecord?id=CVE-2019-11358

- https://www.cve.org/CVERecord?id=CVE-2019-12466

- https://www.cve.org/CVERecord?id=CVE-2019-12467

- https://www.cve.org/CVERecord?id=CVE-2019-12468

- https://www.cve.org/CVERecord?id=CVE-2019-12469

- https://www.cve.org/CVERecord?id=CVE-2019-12470

- https://www.cve.org/CVERecord?id=CVE-2019-12471

- https://www.cve.org/CVERecord?id=CVE-2019-12472

- https://www.cve.org/CVERecord?id=CVE-2019-12473

- https://www.cve.org/CVERecord?id=CVE-2019-12474

Topics%20covered

Topics Covered

security advisory security issue software update XSS mediawiki CSRF Mageia

Resolution

SRPMS

- 7/core/mediawiki-1.31.3-1.mga7

- 6/core/mediawiki-1.27.7-1.mga6

Publication date: 15 Sep 2019
URL: https://advisories.mageia.org/MGASA-2019-0279.html
Type: security
CVE: CVE-2019-11358, CVE-2019-12466, CVE-2019-12467, CVE-2019-12468, CVE-2019-12469, CVE-2019-12470, CVE-2019-12471, CVE-2019-12472, CVE-2019-12473, CVE-2019-12474

Topics%20covered

Topics Covered

security advisory security issue software update XSS mediawiki CSRF Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here