MediaWiki 'Special:PasswordReset' Cross Site Scripting Vulnerability

Bugtraq ID:	67787
Class:	Input Validation Error
CVE:	CVE-2014-3966
Remote:	Yes
Local:	No
Published:	May 19 2014 12:00AM
Updated:	Jun 13 2014 12:03AM
Credit:	Omer Iqbal
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

MediaWiki 'Special:PasswordReset' Cross Site Scripting Vulnerability

MediaWiki is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

MediaWiki prior to 1.22.7, 1.21.10 and 1.19.16 are vulnerable.

MediaWiki 'Special:PasswordReset' Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

MediaWiki 'Special:PasswordReset' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MediaWiki 'Special:PasswordReset' Cross Site Scripting Vulnerability

References:

• MediaWiki Homepage (MediaWiki)