CVE-2014-5241 — Cross-Site Request Forgery in Mediawiki

CWE-352 — Cross-Site Request Forgery5 documents5 sources
Severity
6.8MEDIUMNVD
EPSS
0.3%
top 45.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedAug 22
Latest updateMay 17

Description

The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.19.18+dfsg-0.1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.19.18+dfsg-0.1+3
▶NVDmediawiki/mediawiki1.19.17+47

Patches

Patch: bugzilla.wikimedia.org ↗Patch: bugzilla.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-3qgm-2h8m-458c: The JSONP endpoint in includes/api/ApiFormatJson↗2022-05-17
▶
OSV
CVE-2014-5241: The JSONP endpoint in includes/api/ApiFormatJson↗2014-08-22
▶

📋Vendor Advisories

1
Debian
CVE-2014-5241: mediawiki - The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-5241,CVE-2014-5242,CVE-2014-5243 mediawiki: security issues fixed in the 1.19.18, 1.22.9, and 1.23.2 releases↗2014-07-31
▶
CVE-2014-5241 — Cross-Site Request Forgery in Mediawiki | cvebase