CVE-2010-2787: CSRF
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
Other sources
Tim Starling reported: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=24565#c0
a deficiency in the way MediaWiki processed private cache headers for almost all API operations. Further exact flaw implications from Tim [1]:
A user's browser can be tricked into requesting private data with public caching headers, via a CSRF-style attack on an external web page. The attacker would cause the victim's browser to request private data with public caching headers, then the attacker would download the same data from the intermediate HTTP proxy, bypassing access controls.
References: [2] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2787?
CVE-2010-2787 is rated as a high severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2010-2787?
To fix CVE-2010-2787, update MediaWiki to version 1.15.5 or later to prevent the misuse of public caching headers for private data.
What types of software are affected by CVE-2010-2787?
CVE-2010-2787 affects all MediaWiki versions prior to 1.15.5, including several older versions such as 1.1.0 through 1.15.4.
What are the potential risks of CVE-2010-2787?
The risks of CVE-2010-2787 include the possibility of remote attackers accessing restricted or sensitive information via cached documents.
Is there a known exploit for CVE-2010-2787?
While there is no publicly disclosed exploit for CVE-2010-2787, the vulnerability could be leveraged by attackers with knowledge of how to exploit caching mechanisms.