CVE-2012-1579 — Sensitive Information Exposure in Mediawiki

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.6%
top 31.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedSep 9
Latest updateMay 17

Description

The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDmediawiki/mediawiki7 versions+6

🔴Vulnerability Details

1
GHSA
GHSA-j462-p8hr-gqgc: The resource loader in MediaWiki 1↗2022-05-17
▶

📋Vendor Advisories

1
Debian
CVE-2012-1579: mediawiki - The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 i...↗2012
▶

💬Community

1
Bugzilla
CVE-2012-1579 mediawiki (v1.18.2): Possibility to load user.tokens module remotely↗2012-03-23
▶
CVE-2012-1579 — Sensitive Information Exposure | cvebase