Bug 487489 (CVE-2009-0737)

Summary:	CVE-2009-0737 mediawiki: multiple XSS issues in the installer
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	Axel.Thimm, ian, smooge
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0737
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-06-26 17:33:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	485728
Bug Blocks:

Description Tomas Hoger 2009-02-26 08:59:29 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0737 to the following vulnerability:

Multiple cross-site scripting (XSS) vulnerabilities in the web-based
installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12
before 1.12.4, and 1.13 before 1.13.4, when the installer is in active
use, allow remote attackers to inject arbitrary web script or HTML via
unspecified vectors.

References:
http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTES
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTES
http://www.securityfocus.com/bid/33681
http://secunia.com/advisories/33881
http://www.vupen.com/english/advisories/2009/0368

Comment 1 Tomas Hoger 2009-02-26 09:01:00 UTC

This seems to have quite low impact, as both upstream and Fedora packages recommend removing installer script once site is configured.

Comment 2 Fedora Update System 2009-03-02 17:01:45 UTC

mediawiki-1.14.0-45.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2009-03-02 17:02:30 UTC

mediawiki-1.14.0-45.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.