Summary
The host is running MediaWiki and is prone to information disclosure vulnerabilities.
Impact
Successful exploitation will allow remote attackers to obtain CSRF tokens, bypass the cross-site request forgery (CSRF) protection mechanism and gain knowledge on sensitive directories on the remote web server via requests.
Impact Level: Application
Solution
Upgrade to MediaWiki Version 1.19.8 or 1.20.7 or 1.21.2 or later.
Insight
The flaws are due to,
- An error within the 'tokens', 'unblock', 'login', 'createaccount', and 'block' API calls can be exploited to disclose the CSRF token value.
- The application discloses the full installation path in an error message when an invalid language is specified in ResourceLoader to 'load.php' script.
Affected
MediaWiki version 1.19.x before 1.19.8, 1.20.x before 1.20.7 and 1.21.x before 1.21.2
Detection
Send a crafted data via HTTP GET request and check whether it is vulnerable or not.
References
Severity
Classification
-
CVE CVE-2013-4301, CVE-2013-4302 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N
Related Vulnerabilities