DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
MediaWiki: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-01-13
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
01
beschreibt (9)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-44856US | medium5.3 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due… | ||||
| CVE-2021-44855US | medium5.4 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature. | ||||
| CVE-2021-44854US | medium5.3 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis. | ||||
| CVE-2021-46150US | medium4.8 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demons… | ||||
| CVE-2021-46149US | high7.5 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for… | ||||
| CVE-2021-46148US | medium6.5 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses an… | ||||
| CVE-2021-46147US | high8.8 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. | ||||
| CVE-2021-46146US | medium5.4 | — | ||
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for… | ||||
| CVE-2021-41118US | high7.5 | — | ||
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised inpu… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Debian Security Advisory DLA-3117 vom 2022-09-22external
- Debian Security Advisory DSA-5246 vom 2022-10-04external
- MediaWiki Security Advisory vom 2022-01-13external
- MediaWiki Security Advisory vom 2022-01-13external
- MediaWiki Security Advisory vom 2022-01-13external
- MediaWiki Security Advisory vom 2022-01-13external
- MediaWiki Security Advisory vom 2022-01-13external
- Wikimedia Phabricator Maniphest T293589 vom 2023-01-03external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan