Test ID:	1.3.6.1.4.1.25623.1.1.10.2017.0429
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2017-0429)
Summary:	The remote host is missing an update for the 'mediawiki' package(s) announced via the MGASA-2017-0429 advisory.
Description:	Summary: The remote host is missing an update for the 'mediawiki' package(s) announced via the MGASA-2017-0429 advisory. Vulnerability Insight: XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping (CVE-2017-8808). Reflected File Download from api.php (CVE-2017-8809). On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password (CVE-2017-8810). It's possible to mangle HTML via raw message parameter expansion (CVE-2017-8811). The id attribute on headlines allow raw > (CVE-2017-8812). Language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition (CVE-2017-8814). Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815). composer.json has require-dev versions of PHPUnit with known security issues (CVE-2017-9841). Note that MediaWiki 1.23.x on Mageia 5 is no longer supported. Those using the mediawiki package on Mageia 5 should upgrade to Mageia 6. Affected Software/OS: 'mediawiki' package(s) on Mageia 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-8808 Debian Security Information: DSA-4036 (Google Search) https://www.debian.org/security/2017/dsa-4036 http://www.securitytracker.com/id/1039812 Common Vulnerability Exposure (CVE) ID: CVE-2017-8809 Common Vulnerability Exposure (CVE) ID: CVE-2017-8810 Common Vulnerability Exposure (CVE) ID: CVE-2017-8811 Common Vulnerability Exposure (CVE) ID: CVE-2017-8812 Common Vulnerability Exposure (CVE) ID: CVE-2017-8814 Common Vulnerability Exposure (CVE) ID: CVE-2017-8815 Common Vulnerability Exposure (CVE) ID: CVE-2017-9841 BugTraq ID: 101798 http://www.securityfocus.com/bid/101798 https://security.gentoo.org/glsa/201711-15 http://web.archive.org/web/20170701212357/http://phpunit.vulnbusters.com/ https://github.com/sebastianbergmann/phpunit/commit/284a69fb88a2d0845d23f42974a583d8f59bf5a5 https://github.com/sebastianbergmann/phpunit/pull/1956 https://www.oracle.com/security-alerts/cpuoct2021.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.