Vulnerability Details : CVE-2012-1578
Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.
Vulnerability category: Cross-site request forgery (CSRF)
Exploit prediction scoring system (EPSS) score for CVE-2012-1578
Probability of exploitation activity in the next 30 days: 0.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-1578
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2012-1578
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-1578
-
http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html
[MediaWiki-announce] MediaWiki security and maintenance release 1.17.3
-
http://www.openwall.com/lists/oss-security/2012/03/22/9
oss-security - MediaWiki security and maintenance release 1.18.2
-
https://bugzilla.wikimedia.org/show_bug.cgi?id=34212
⚓ T36212 ApiBlock/ApiUnblock allow action to take place without a token parameter present
-
http://www.openwall.com/lists/oss-security/2012/03/24/1
oss-security - CVEs for MediaWiki security and maintenance release 1.18.2
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/78911
MediaWiki mutliple cross-site request forgery CVE-2012-1578 Vulnerability Report
-
http://www.securityfocus.com/bid/52689
MediaWiki Multiple Security Vulnerabilities
-
http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html
[MediaWiki-announce] MediaWiki security and maintenance release 1.18.2Vendor Advisory
Products affected by CVE-2012-1578
- cpe:2.3:a:mediawiki:mediawiki:1.17.1:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.17.2:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.17:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.17.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.17:beta_1:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.18:beta_1:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.18:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.18.0:*:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.18.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:mediawiki:mediawiki:1.18.1:*:*:*:*:*:*:*