MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
BID:65883
Info
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
| Bugtraq ID: | 65883 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-2243 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 28 2014 12:00AM |
| Updated: | Apr 13 2015 09:49PM |
| Credit: | Mario Gomes, Aaron and Michael M. |
| Vulnerable: |
MediaWiki Mediawiki 1.21.4 MediaWiki Mediawiki 1.21.3 MediaWiki Mediawiki 1.21.2 MediaWiki Mediawiki 1.21.1 MediaWiki Mediawiki 1.19.10 MediaWiki Mediawiki 1.19.9 MediaWiki Mediawiki 1.19.8 MediaWiki Mediawiki 1.19.7 MediaWiki Mediawiki 1.19.6 MediaWiki Mediawiki 1.19.5 MediaWiki Mediawiki 1.19.4 MediaWiki Mediawiki 1.19.3 MediaWiki Mediawiki 1.19.2 MediaWiki Mediawiki 1.19.1 MediaWiki Mediawiki 1.19 MediaWiki Mediawiki 1.22.2 MediaWiki Mediawiki 1.22.1 MediaWiki Mediawiki 1.22.0 MediaWiki Mediawiki 1.21.5 MediaWiki Mediawiki 1.19.11 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 |
| Not Vulnerable: |
MediaWiki Mediawiki 1.22.3 MediaWiki Mediawiki 1.21.6 MediaWiki Mediawiki 1.19.12 |
Discussion
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
MediaWiki is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information.
Note: This BID was previously titled 'MediaWiki Multiple Security Vulnerabilities', but the issue described by CVE-2014-2242 and CVE-2014-2244 has been moved to BID 65910 (MediaWiki CVE-2014-2242 Cross Site Scripting Vulnerability) and 65906 (MediaWiki 'text' Prameter HTML Injection Vulnerability) respectively to better document it.
Versions prior to MediaWiki 1.22.3, 1.21.6, and 1.19.12 are vulnerable.
MediaWiki is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information.
Note: This BID was previously titled 'MediaWiki Multiple Security Vulnerabilities', but the issue described by CVE-2014-2242 and CVE-2014-2244 has been moved to BID 65910 (MediaWiki CVE-2014-2242 Cross Site Scripting Vulnerability) and 65906 (MediaWiki 'text' Prameter HTML Injection Vulnerability) respectively to better document it.
Versions prior to MediaWiki 1.22.3, 1.21.6, and 1.19.12 are vulnerable.
Exploit / POC
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
Attackers can exploit this issue using a browser or readily available tools.
Attackers can exploit this issue using a browser or readily available tools.
Solution / Fix
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva mediawiki-1.22.3-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva mediawiki-ldapauthentication-2.0f-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva mediawiki-mysql-1.22.3-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva mediawiki-pgsql-1.22.3-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva mediawiki-sqlite-1.22.3-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/
References
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
References:
References:
- MediaWiki Homepage (MediaWiki)
- MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12 (WikiMedia)
- Timing attack on Token (WikiMedia)