- (T109140) (T122209) Special:UserLogin and Special:Search     allow redirect to interwiki links. (CVE-2017-0363,     CVE-2017-0364)

  - (T144845) XSS in SearchHighlighter::highlightText() when     $wgAdvancedSearchHighlighting is true. (CVE-2017-0365)

  - (T125177) API parameters may now be marked as     'sensitive' to keep their values out of the logs.
    (CVE-2017-0361)

  - (T150044) 'Mark all pages visited' on the watchlist now     requires a CSRF token. (CVE-2017-0362)

  - (T156184) Escape content model/format url parameter in     message. (CVE-2017-0368)

  - (T151735) SVG filter evasion using default attribute     values in DTD declaration. (CVE-2017-0366)

  - (T48143) Spam blacklist ineffective on encoded URLs     inside file inclusion syntax's link parameter.
    (CVE-2017-0370)

  - (T108138) Sysops can undelete pages, although the page     is protected against it. (CVE-2017-0369)

The following only affects 1.27 and above and is not included in the 1.23 upgrade :

  - (T161453) LocalisationCache will no longer use the     temporary directory in its fallback chain when trying to     work out where to write the cache. (CVE-2017-0367)

The following fix is for the SyntaxHighlight extension :

  - (T158689) Parameters injection in SyntaxHighlight     results in multiple vulnerabilities. (CVE-2017-0372)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

-（T109140）（T122209）Special：UserLoginおよびSpecial：検索により、インターウィキリンクへのリダイレクトが可能になります。（CVE-2017-0363、CVE-2017-0364）

  -（T144845）SearchHighlighterのXSS：：$wgAdvancedSearchHighlightingがtrueの場合、highlightText()。（CVE-2017-0365）

  -（T125177）APIパラメーターは、その値をログに保持しないように「機密」としてマークされるようになりました。
    （CVE-2017-0361）

  -（T150044）ウォッチリストの「閲覧したすべてのページをマーク」には、CSRFトークンが必要になりました。（CVE-2017-0362）

  -（T156184）メッセージのエスケープコンテンツモデル/フォーマットurlパラメーター。（CVE-2017-0368）

  -（T151735）DTD宣言でデフォルトの属性値を使用するSVGフィルター回避。（CVE-2017-0366）

  -（T48143）ファイルインクルードシンタックスのリンクパラメーター内のエンコードされたURLで無効なスパムブラックリスト。
    （CVE-2017-0370）

  -（T108138）Sysopsはページを元に戻す可能性がありますが、ページは保護されています。（CVE-2017-0369）

以下は1.27以上にのみ影響し、1.23アップグレードには含まれません：

  -（T161453）LocalizationCacheは、キャッシュの書き込み先を見つけようとするとき、フォールバックチェーンで一時ディレクトリを使用しなくなりました。（CVE-2017-0367）

以下の修正は、SyntaxHighlight拡張に対するものです：

  -（T158689）SyntaxHighlightのパラメーターインジェクションにより、複数の脆弱性があります。（CVE-2017-0372）

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The version of MediaWiki installed is 1.23.x prior to 1.23.16, 1.27.x prior to 1.27.2, or 1.28.x prior to 1.28.1, and is affected by multiple vulnerabilities :

 - A flaw exists that is due to the program storing sensitive parameter information in 'api.log' in plaintext. This may allow a local attacker to gain access to password information. (CVE-2017-0361)
 - A flaw exists as HTTP requests to 'includes/specials/SpecialWatchlist.php' do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF/XSRF) attack causing the victim to mark all pages as visited in a watchlist. (CVE-2017-0362)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'highlightText()' function in 'includes/search/SearchHighlighter.php' does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0365)
 - A flaw exists that allows a stored XSS attack. This flaw exists because the program does not validate input when handling uploaded SVG files before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0366)
 - A flaw exists in the 'includes/cache/localisation/LocalisationCache.php' script that is triggered as the 'LocalisationCache' will fall back to the insecure temporary directory when determining the location to write the cache, potentially disclosing sensitive information to a local attacker. (CVE-2017-0367)
 - A flaw exists in the 'includes/EditPage.php' script that is triggered as input passed via the message parser is not properly sanitized when using the rawHTML mode. This may allow a remote attacker to potentially inject arbitrary HTML content. (CVE-2017-0368)
 - A flaw exists that may allow an authenticated remote attacker to potentially undelete a page without the appropriate authorizations. (CVE-2017-0369)
 - A flaw exists in the 'includes/parser/Parser.php' script that is triggered as the spam blacklist features does not properly function on encoded URLs in the file inclusion syntax's link parameter. This may allow a remote attacker to bypass blacklist protection mechanisms. (CVE-2017-0370)
 - A flaw exists that allows a stored XSS attack. This flaw exists because the 'SyntaxHighlight_GeSHi.class.php' script does not validate input to the 'start' parameter before returning it to users. This may allow a remote attacker to create a specially crafted request that will execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2017-0372)

ID	名稱	產品	系列	已發布	已更新	嚴重性
99408	Fedora 25 : mediawiki (2017-3fb95ed01f)	Nessus	Fedora Local Security Checks	2017/4/17	2021/1/11	critical
99408	Fedora 25：mediawiki（2017-3fb95ed01f）	Nessus	Fedora Local Security Checks	2017/4/17	2021/1/11	critical
700053	MediaWiki 1.23.x < 1.23.16 / 1.27.x < 1.27.2 / 1.28.x < 1.28.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2017/4/10	2019/3/6	medium

偵測

搜尋 Plugin

critical

critical

medium