Mediawiki Caching Session Cookies Information Disclosure Vulnerability
BID:63757
Info
Mediawiki Caching Session Cookies Information Disclosure Vulnerability
| Bugtraq ID: | 63757 |
| Class: | Design Error |
| CVE: |
CVE-2013-4572 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 19 2013 12:00AM |
| Updated: | May 07 2015 05:11PM |
| Credit: | Reported by the vendor. |
| Vulnerable: |
MediaWiki Mediawiki 1.21.2 MediaWiki Mediawiki 1.21.1 MediaWiki Mediawiki 1.20.7 MediaWiki Mediawiki 1.20.6 MediaWiki Mediawiki 1.20.5 MediaWiki Mediawiki 1.20.4 MediaWiki Mediawiki 1.20.3 MediaWiki Mediawiki 1.20.2 MediaWiki Mediawiki 1.20.1 MediaWiki Mediawiki 1.19.8 MediaWiki Mediawiki 1.19.7 MediaWiki Mediawiki 1.19.6 MediaWiki Mediawiki 1.19.5 MediaWiki Mediawiki 1.19.4 MediaWiki Mediawiki 1.19.3 MediaWiki Mediawiki 1.19.2 MediaWiki Mediawiki 1.19.1 MediaWiki Mediawiki 1.20 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
MediaWiki Mediawiki 1.21.3 MediaWiki Mediawiki 1.20.8 MediaWiki Mediawiki 1.19.9 |
Discussion
Mediawiki Caching Session Cookies Information Disclosure Vulnerability
Mediawiki is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Mediawiki 1.19.9, 1.20.8 and 1.21.3 are vulnerable.
Mediawiki is prone to an information-disclosure vulnerability.
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
Versions prior to Mediawiki 1.19.9, 1.20.8 and 1.21.3 are vulnerable.
Exploit / POC
Mediawiki Caching Session Cookies Information Disclosure Vulnerability
Attackers can exploit this issue using a browser or readily available tools.
Attackers can exploit this issue using a browser or readily available tools.
Solution / Fix
Mediawiki Caching Session Cookies Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Mediawiki Caching Session Cookies Information Disclosure Vulnerability
References:
References:
- [MediaWiki-announce] MediaWiki Security Release: 1.21.3, 1.20.8 and 1.19.9 (MediaWiki )
- Bug 1030987 - (CVE-2013-4567, CVE-2013-4568, CVE-2013-4572) CVE-2013-4567 CVE-20 (Red Hat Bugzilla)
- Bug 53032 - Multiple users with the same session ID (MediaWiki )
- Full release notes for 1.19.9 (MediaWiki )
- Full release notes for 1.20.8 (MediaWiki )
- Full release notes for 1.21.3 (MediaWiki )
- MediaWiki Homepage (MediaWiki)