| Vulnerability Name: | CVE-2012-1578 (CCN-78911) | ||||||||
| Assigned: | 2012-03-22 | ||||||||
| Published: | 2012-03-22 | ||||||||
| Updated: | 2017-08-29 | ||||||||
| Summary: | Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-352 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2012-1578 Source: CCN Type: MediaWiki Web Site MediaWiki security and maintenance release 1.17.3 Source: MLIST Type: UNKNOWN [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 Source: MLIST Type: Vendor Advisory [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 Source: OSVDB Type: UNKNOWN 80361 Source: CCN Type: SA48504 MediaWiki Multiple Vulnerabilities Source: SECUNIA Type: Vendor Advisory 48504 Source: MLIST Type: UNKNOWN [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 Source: MLIST Type: UNKNOWN [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 Source: CCN Type: OSVDB ID: 80361 MediaWiki User Blocking Manipulation CSRF Source: BID Type: UNKNOWN 52689 Source: CCN Type: BID-52689 MediaWiki Multiple Security Vulnerabilities Source: CONFIRM Type: UNKNOWN https://bugzilla.wikimedia.org/show_bug.cgi?id=34212 Source: XF Type: UNKNOWN mediawiki-multiple-csrf(78911) Source: XF Type: UNKNOWN mediawiki-multiple-csrf(78911) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||