Multiple vulnerabilities in MediaWiki and extensions

Beschreibung

Multiple serious vulnerabilities have been found in MediaWiki. Malicious users can exploit these vulnerabilities to bypass security restrictions, inject arbitrary code, cause denial of service or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Unknown vulnerability can be exploited remotely via a specially designed SVG, PDF, password or entity manipuations;
2. XSS vulnerability in CheckUser extension can be exploited remotely via a specially designed request;
3. CSRF vulnerability in Scripunto extension can be exploited remotely via an unknown vectors;
4. XSS vulnerability can be exploited remotely via a specially designed JS or string;
5. Improper entities handle can be exploited remotely via a specially designed SVG file;
6. Incomplete blacklist can be exploited remotely via a specially designed XLink or SVG.

Ursprüngliche Informationshinweise

• MediaWiki notice

CVE Liste

• CVE-2015-2941
  high
• CVE-2015-2942
  high
• CVE-2015-2932
  high
• CVE-2015-2931
  high
• CVE-2015-2938
  high
• CVE-2015-2937
  high
• CVE-2015-2936
  high
• CVE-2015-2935
  high
• CVE-2015-2939
  high
• CVE-2015-2940
  high
• CVE-2015-2933
  high
• CVE-2015-2934
  high

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com