Test ID:	1.3.6.1.4.1.25623.1.0.106784
Category:	Web application abuses
Title:	MediaWiki Multiple Vulnerabilities (Aug 2016) - Windows
Summary:	MediaWiki is prone to multiple vulnerabilities.
Description:	Summary: MediaWiki is prone to multiple vulnerabilities. Vulnerability Insight: The following flaws exist: - ApiParse allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php. (CVE-2016-6331) - Remote attackers may obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked and when $wgBlockDisablesLogin is true. (CVE-2016-6332) - Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css. (CVE-2016-6333) - Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links. (CVE-2016-6334) - MediaWiki does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php. (CVE-2016-6335) - Remote authenticated users with undelete permissions may bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete. (CVE-2016-6336) - Remote attackers may bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights. (CVE-2016-6337) Affected Software/OS: MediaWiki versions prior to 1.23.15, 1.26.x prior to 1.26.4 and 1.27.x prior to 1.27.1. Solution: Update to version 1.23.15, 1.26.4, 1.27.1 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6331 https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html Common Vulnerability Exposure (CVE) ID: CVE-2016-6332 Common Vulnerability Exposure (CVE) ID: CVE-2016-6333 BugTraq ID: 98053 http://www.securityfocus.com/bid/98053 Common Vulnerability Exposure (CVE) ID: CVE-2016-6334 BugTraq ID: 98057 http://www.securityfocus.com/bid/98057 Common Vulnerability Exposure (CVE) ID: CVE-2016-6335 Common Vulnerability Exposure (CVE) ID: CVE-2016-6336 Common Vulnerability Exposure (CVE) ID: CVE-2016-6337
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.