Vulnerability in Wikimedia Foundation Scribunto.

This issue affects Scribunto: from 1.45.0 before 1.45.2.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php.

This issue affects MediaWiki: from before 1.39.14, 1.43.4, 1.44.1; Parsoid: from before 0.16.6, 0.20.4, 0.21.1.

Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTagsbody.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability.

Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.

An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.

An information disclosure flaw was found in the way MediaWiki, the wiki engine, processed 'curid' and 'oldid' request paramaters. A remote attacker could use this flaw to enumerate page titles on private MediaWiki installations.

Upstream bug report: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=32276

An information disclosure flaw was found in the way MediaWiki, the wiki engine, performed action=ajax requests dispatching to relevant internal functions. These requests were dispatched without any read permissions checks being done. A remote attacker could use this flaw to obtain data on private MediaWiki installations.

Upstream bug report: [2] https://bugzilla.wikimedia.org/showbug.cgi?id=32616

References: [3] http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-November/000104.html [4] http://www.openwall.com/lists/oss-security/2011/11/29/6 [5] https://bugs.gentoo.org/showbug.cgi?id=392383

Upstream patch (covering both of the issues): [6] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/104506

Mediawiki 1.16.5 was released [1] to correct two security flaws:

The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions we introduced had to be updated to match longer extensions. (CVE-2011-1765)

For more details, see https://bugzilla.wikimedia.org/showbug.cgi?id=28534

The second issue allows unauthenticated users to gain additional rights, on wikis where $wgBlockDisablesLogin is enabled. By default, it is disabled. The issue occurs when a malicious user sends cookies which contain the user name and user ID of a "victim" account. In certain circumstances, the rights of the victim are loaded and persist throughout the malicious request, allowing the malicious user to perform actions with the victim's rights. (CVE-2011-1766)

$wgBlockDisablesLogin is a feature which is sometimes used on private wikis to prevent users who have an account from logging in and viewing content on the wiki.

For more details, see https://bugzilla.wikimedia.org/showbug.cgi?id=28639

[1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html

MediaWiki upstream has released: [1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html

v1.16.0 and v.1.15.5 versions of MediaWiki, addressing the following XSS flaw (from [1]):

A cross-site scripting (XSS) vulnerability was discovered in profileinfo.php. The vulnerability is only exposed when the script is explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true.

Tim Starling reported: [1] https://bugzilla.wikimedia.org/showbug.cgi?id=24565#c0

a deficiency in the way MediaWiki processed private cache headers for almost all API operations. Further exact flaw implications from Tim [1]:

A user's browser can be tricked into requesting private data with public caching headers, via a CSRF-style attack on an external web page. The attacker would cause the victim's browser to request private data with public caching headers, then the attacker would download the same data from the intermediate HTTP proxy, bypassing access controls.

References: [2] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html

MediaWiki upstream has released: [1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html

latest, v.1.15.3 version, addressing one cross-site request forgery (CSRF) issue (from [1]):

"MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password."

Upstream bug report: [2] https://bugzilla.wikimedia.org/showbug.cgi?id=23076

CVE Request (and reply): [3] http://www.openwall.com/lists/oss-security/2010/04/07/1 [4] http://www.openwall.com/lists/oss-security/2010/04/08/4

MediaWiki upstream has released new v1.15.2 version: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html

of MediaWiki fixing two security issues (from upstream announcement):

a, "A CSS validation issue was discovered which allows editors to display external images in wiki pages. This is a privacy concern on public wikis, since a malicious user may link to an image on a server they control, which would allow that attacker to gather IP addresses and other information from users of the public wiki. All sites running publicly-editable MediaWiki installations are advised to upgrade. All versions of MediaWiki (prior to this one) are affected."

CVE identifier of CVE-2010-1189 has been assigned to this.

--

b, "A data leakage vulnerability was discovered in thumb.php which affects wikis which restrict access to private files using imgauth.php, or some similar scheme. All versions of MediaWiki since 1.5 are affected.

Deleting thumb.php is a suitable workaround for private wikis which do not use $wgThumbnailScriptPath or $wgLocalRepo['thumbScriptUrl']."

CVE identifier of CVE-2010-1190 has been assigned to this.

Upstream patch: http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.2.patch.gz

References: http://secunia.com/advisories/38856/

CVE Request: http://www.openwall.com/lists/oss-security/2010/03/09/4