Vulnerability CVE-2014-5243 - CERT Civis.Net

Vulnerability Name:

CVE-2014-5243 (CCN-95067)

Assigned:

2014-07-30

Published:

2014-07-30

Updated:

2017-01-07

Summary:

MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CONFIRM
Type: UNKNOWN
http://advisories.mageia.org/MGASA-2014-0309.html

Source: MITRE
Type: CNA
CVE-2014-5243

Source: CCN
Type: MediaWiki Mailing List, Wed Jul 30 20:10:55 UTC 2014
MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2

Source: MLIST
Type: UNKNOWN
[oss-security] 20140814 Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2

Source: SECUNIA
Type: UNKNOWN
59738

Source: DEBIAN
Type: UNKNOWN
DSA-3011

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2014:153

Source: CCN
Type: MediaWiki Web site
MediaWiki

Source: CCN
Type: BID-69137
MediaWiki Unspecified Clickjacking Vulnerability

Source: CONFIRM
Type: Exploit, Patch
https://bugzilla.wikimedia.org/show_bug.cgi?id=65778

Source: XF
Type: UNKNOWN
mediawiki-outputpage-clickjacking(95067)

Source: MLIST
Type: UNKNOWN
[MediaWiki-announce] 20140730 MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2

Vulnerable Configuration:

Configuration 1:

cpe:/a:mediawiki:mediawiki:1.19:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19:beta_1:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19:beta_2:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.8:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.9:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.10:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.11:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.12:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.13:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.14:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.15:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.16:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:*:*:*:*:*:*:*:* (Version <= 1.19.17)

OR cpe:/a:mediawiki:mediawiki:1.20.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.4:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.5:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.7:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.20.8:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.4:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.5:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.7:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.8:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.9:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.10:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.4:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.5:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.7:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.8:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.23.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.23.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mediawiki:mediawiki:1.19.15:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.9:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:26197	P	DSA-3011-1 mediawiki - security update	2014-10-27
oval:com.ubuntu.bionic:def:201452430000000	V	CVE-2014-5243 on Ubuntu 18.04 LTS (bionic) - medium.	2014-08-22
oval:com.ubuntu.artful:def:20145243000	V	CVE-2014-5243 on Ubuntu 17.10 (artful) - medium.	2014-08-22
oval:com.ubuntu.trusty:def:20145243000	V	CVE-2014-5243 on Ubuntu 14.04 LTS (trusty) - medium.	2014-08-22
oval:com.ubuntu.disco:def:201452430000000	V	CVE-2014-5243 on Ubuntu 19.04 (disco) - medium.	2014-08-22
oval:com.ubuntu.bionic:def:20145243000	V	CVE-2014-5243 on Ubuntu 18.04 LTS (bionic) - medium.	2014-08-22
oval:com.ubuntu.cosmic:def:20145243000	V	CVE-2014-5243 on Ubuntu 18.10 (cosmic) - medium.	2014-08-22
oval:com.ubuntu.cosmic:def:201452430000000	V	CVE-2014-5243 on Ubuntu 18.10 (cosmic) - medium.	2014-08-22
oval:com.ubuntu.precise:def:20145243000	V	CVE-2014-5243 on Ubuntu 12.04 LTS (precise) - medium.	2014-08-22