DSA-4767: -1 mediawiki -- security update
mediawiki - security update
Other sources
Multiple security issues were discovered in MediaWiki, a website engine for collaborative work: SpecialUserRights could leak whether a user existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts.
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which MediaWiki features are implicated by these issues?
The affected areas include SpecialUserRights, multiple code paths that render HTML without sanitisation, and TOTP validation.
What could an attacker achieve through the cross-site scripting issues?
The affected code paths allow cross-site scripting because they lack HTML sanitisation. The provided information does not identify the specific paths or required attacker privileges.
Is account-related information exposed?
SpecialUserRights could reveal whether a user exists, allowing user-account enumeration.
What makes the TOTP issue relevant to authentication security?
TOTP validation had insufficient rate limiting against brute-force attempts, which could make repeated attempts against TOTP authentication possible.