CVE-2012-1578

Published: Sep 9, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.

Affected (11)

Products: Mediawiki: Mediawiki

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Version 1.17.0
Mediawiki Mediawiki	Version 1.17.0 rc1
Mediawiki Mediawiki	Version 1.17.1
Mediawiki Mediawiki	Version 1.17.2
Mediawiki Mediawiki	Version 1.17
Mediawiki Mediawiki	Version 1.17 beta_1

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Version 1.18.0
Mediawiki Mediawiki	Version 1.18.0 rc1
Mediawiki Mediawiki	Version 1.18.1
Mediawiki Mediawiki	Version 1.18
Mediawiki Mediawiki	Version 1.18 beta_1

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (18)

http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html

Source: secalert@redhat.com

http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html

Source: secalert@redhat.com

Vendor Advisory

http://osvdb.org/80361

Source: secalert@redhat.com

http://secunia.com/advisories/48504

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/03/22/9

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/24/1

Source: secalert@redhat.com

http://www.securityfocus.com/bid/52689

Source: secalert@redhat.com

https://bugzilla.wikimedia.org/show_bug.cgi?id=34212

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/78911

Source: secalert@redhat.com

http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://osvdb.org/80361

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48504

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/03/22/9

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/03/24/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/52689

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.wikimedia.org/show_bug.cgi?id=34212

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/78911

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.