ID de Prueba:	1.3.6.1.4.1.25623.1.0.804166
Categoría:	Web application abuses
Título:	MediaWiki < 1.19.8, 1.20.x < 1.20.7, 1.21.x < 1.21.2 Information Disclosure Vulnerabilities (Dec 2013) - Active Check
Resumen:	MediaWiki is prone to multiple information disclosure; vulnerabilities.
Descripción:	Summary: MediaWiki is prone to multiple information disclosure vulnerabilities. Vulnerability Insight: The flaws are due to: - An error within the 'tokens', 'unblock', 'login', 'createaccount', and 'block' API calls that can be exploited to disclose the CSRF token value. - The application discloses the full installation path in an error message when an invalid language is specified in ResourceLoader to 'load.php' script. Vulnerability Impact: Successful exploitation will allow remote attackers to obtain CSRF tokens, bypass the cross-site request forgery (CSRF) protection mechanism and gain knowledge on sensitive directories on the remote web server via requests. Affected Software/OS: MediaWiki versions 1.19.x prior to 1.19.8, 1.20.x prior to 1.20.7 and 1.21.x prior to 1.21.2. Solution: Update to version 1.19.8, 1.20.7, 1.21.2 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4302 Debian Security Information: DSA-2753 (Google Search) http://www.debian.org/security/2013/dsa-2753 http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html http://seclists.org/oss-sec/2013/q3/553 http://osvdb.org/96912 http://secunia.com/advisories/54715 XForce ISS Database: mediawiki-cve20134302-info-disclosure(86896) https://exchange.xforce.ibmcloud.com/vulnerabilities/86896 Common Vulnerability Exposure (CVE) ID: CVE-2013-4301 http://osvdb.org/96913 XForce ISS Database: mediawiki-cve20134301-info-disclosure(86895) https://exchange.xforce.ibmcloud.com/vulnerabilities/86895
Copyright	Copyright (C) 2013 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.