CVE-2012-1580: CSRF
Published Sep 9, 2012
·Updated
Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files.
Affected Software
11 affected components
MediaWiki MediaWiki=1.17
MediaWiki MediaWiki=1.17-beta_1
MediaWiki MediaWiki=1.17.0
MediaWiki MediaWiki=1.17.0-rc1
MediaWiki MediaWiki=1.17.1
MediaWiki MediaWiki=1.17.2
MediaWiki MediaWiki=1.18
MediaWiki MediaWiki=1.18-beta_1
MediaWiki MediaWiki=1.18.0
MediaWiki MediaWiki=1.18.0-rc1
MediaWiki MediaWiki=1.18.1
Event History
Sep 9, 2012
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1580?
CVE-2012-1580 is considered a moderate severity vulnerability due to its ability to facilitate cross-site request forgery (CSRF) attacks.
2
How do I fix CVE-2012-1580?
To fix CVE-2012-1580, upgrade MediaWiki to version 1.17.3 or later, or 1.18.2 or later.
3
Who is affected by CVE-2012-1580?
CVE-2012-1580 affects MediaWiki versions 1.17.x prior to 1.17.3 and 1.18.x prior to 1.18.2.
4
What types of attacks can be executed using CVE-2012-1580?
CVE-2012-1580 can be exploited by remote attackers to hijack the authentication of victims for file upload requests.
5
When was CVE-2012-1580 disclosed?
CVE-2012-1580 was disclosed in March 2012.