Test ID:	1.3.6.1.4.1.25623.1.0.804166
Category:	Web application abuses
Title:	MediaWiki < 1.19.8, 1.20.x < 1.20.7, 1.21.x < 1.21.2 Information Disclosure Vulnerabilities (Dec 2013) - Active Check
Summary:	MediaWiki is prone to multiple information disclosure; vulnerabilities.
Description:	Summary: MediaWiki is prone to multiple information disclosure vulnerabilities. Vulnerability Insight: The flaws are due to: - An error within the 'tokens', 'unblock', 'login', 'createaccount', and 'block' API calls that can be exploited to disclose the CSRF token value. - The application discloses the full installation path in an error message when an invalid language is specified in ResourceLoader to 'load.php' script. Vulnerability Impact: Successful exploitation will allow remote attackers to obtain CSRF tokens, bypass the cross-site request forgery (CSRF) protection mechanism and gain knowledge on sensitive directories on the remote web server via requests. Affected Software/OS: MediaWiki versions 1.19.x prior to 1.19.8, 1.20.x prior to 1.20.7 and 1.21.x prior to 1.21.2. Solution: Update to version 1.19.8, 1.20.7, 1.21.2 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4302 Debian Security Information: DSA-2753 (Google Search) http://www.debian.org/security/2013/dsa-2753 http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html http://seclists.org/oss-sec/2013/q3/553 http://osvdb.org/96912 http://secunia.com/advisories/54715 XForce ISS Database: mediawiki-cve20134302-info-disclosure(86896) https://exchange.xforce.ibmcloud.com/vulnerabilities/86896 Common Vulnerability Exposure (CVE) ID: CVE-2013-4301 http://osvdb.org/96913 XForce ISS Database: mediawiki-cve20134301-info-disclosure(86895) https://exchange.xforce.ibmcloud.com/vulnerabilities/86895
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.