CVE-2012-1578

MediaWiki 1.17.x < 1.17.3 and 1.18.x < 1.18.2 - Cross-Site Request Forgery via Block/Unblock Module

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78911
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/03/24/1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48504
Issue Tracking x_refsource_confirm
https://bugzilla.wikimedia.org/show_bug.cgi?id=34212
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/03/22/9
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/80361
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/52689

Scores

EPSS 0.0030
EPSS Percentile 53.6%

Details

CWE
CWE-352
Status published
Products (7)
mediawiki/mediawiki 1.17 (2 CPE variants)
mediawiki/mediawiki 1.17.0 (2 CPE variants)
mediawiki/mediawiki 1.17.1
mediawiki/mediawiki 1.17.2
mediawiki/mediawiki 1.18 (2 CPE variants)
mediawiki/mediawiki 1.18.0 (2 CPE variants)
mediawiki/mediawiki 1.18.1
Published Sep 09, 2012
Tracked Since Feb 18, 2026