CVE-2010-1150: CSRF
MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.
Other sources
MediaWiki upstream has released: [1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
latest, v.1.15.3 version, addressing one cross-site request forgery (CSRF) issue (from [1]):
"MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password."
Upstream bug report: [2] https://bugzilla.wikimedia.org/showbug.cgi?id=23076
CVE Request (and reply): [3] http://www.openwall.com/lists/oss-security/2010/04/07/1 [4] http://www.openwall.com/lists/oss-security/2010/04/08/4
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1150?
CVE-2010-1150 is considered a moderate severity vulnerability as it allows for potential phishing attacks by authenticated users.
How do I fix CVE-2010-1150?
To fix CVE-2010-1150, upgrade to MediaWiki version 1.15.3 or later or 1.16.0beta2 or later.
What types of accounts are affected by CVE-2010-1150?
CVE-2010-1150 affects MediaWiki installations where authenticated users can inadvertently log in as another user.
Are there any workarounds for CVE-2010-1150?
One potential workaround for CVE-2010-1150 is to restrict authenticated user login capabilities until the software is upgraded.
Which versions of MediaWiki are vulnerable to CVE-2010-1150?
Versions of MediaWiki before 1.15.3 and 1.6.x before 1.16.0beta2 are vulnerable to CVE-2010-1150.