Description

The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.

Remediation

References

CVE-2011-1580

Related Vulnerabilities

Drupal Incorrect Authorization Vulnerability (CVE-2017-6377)

Chamilo URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2015-9540)

Atlassian Jira Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-20409)

PHP Other Vulnerability (CVE-2015-8835)

WordPress Plugin AJAX Comment Page Cross-Site Scripting (3.25)

Severity

Low

Classification

CVE-2011-1580 CWE-20

Tags

Missing Update Known Vulnerabilities