CVE-2012-5391: Medium severity MediaWiki MediaWiki vulnerability
Published Jun 2, 2014
·Updated
Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the sessionid.
Affected Software
15 affected components
MediaWiki MediaWiki<=1.18.5
MediaWiki MediaWiki=1.18
MediaWiki MediaWiki=1.18-beta_1
MediaWiki MediaWiki=1.18.0
MediaWiki MediaWiki=1.18.0-rc1
MediaWiki MediaWiki=1.18.1
MediaWiki MediaWiki=1.18.2
MediaWiki MediaWiki=1.18.3
MediaWiki MediaWiki=1.18.4
MediaWiki MediaWiki=1.19
MediaWiki MediaWiki=1.19-beta_1
MediaWiki MediaWiki=1.19-beta_2
MediaWiki MediaWiki=1.19.1
MediaWiki MediaWiki=1.19.2
MediaWiki MediaWiki=1.20
Event History
Jun 2, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:55 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-5391?
CVE-2012-5391 is classified as a high severity vulnerability due to its potential for session hijacking.
2
How do I fix CVE-2012-5391?
To fix CVE-2012-5391, upgrade your MediaWiki installation to versions 1.18.6, 1.19.3 or later, or 1.20.1.
3
Which versions of MediaWiki are affected by CVE-2012-5391?
CVE-2012-5391 affects MediaWiki versions prior to 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1.
4
What type of attack does CVE-2012-5391 enable?
CVE-2012-5391 enables remote attackers to hijack web sessions through session fixation.
5
Are there workarounds for CVE-2012-5391?
While upgrading is the recommended solution, mitigating the risk may include implementing additional session management controls.