{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-03-22T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "mediawiki-multiple-csrf(78911)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78911"}, {"name": "[oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/03/24/1"}, {"name": "[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html"}, {"name": "48504", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/48504"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=34212"}, {"name": "[MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html"}, {"name": "[oss-security] 20120322 MediaWiki security and maintenance release 1.18.2", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/03/22/9"}, {"name": "80361", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/80361"}, {"name": "52689", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/52689"}]}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-1578", "datePublished": "2012-09-09T21:00:00", "dateReserved": "2012-03-12T00:00:00", "dateUpdated": "2017-08-28T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17:*:*:*:*:*:*:*", "matchCriteriaId": "F9AC7B4F-6AE2-4FCC-80DA-0D068E479853", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17:beta_1:*:*:*:*:*:*", "matchCriteriaId": "57F3C3BF-CA6A-4BCC-83CE-32560F0A437D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17.0:*:*:*:*:*:*:*", "matchCriteriaId": "B6D1B676-AE23-4FC5-8466-EB44B8F756CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "1C3B8FFB-25AD-4165-8C87-DBF5977572FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "52E0CED2-EF96-4052-A4BC-4657163B4FE5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.17.2:*:*:*:*:*:*:*", "matchCriteriaId": "2E8D954D-484E-4DAA-8E0E-6CEAC17BBA22", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.18:*:*:*:*:*:*:*", "matchCriteriaId": "6EBD4E4C-DE1D-4007-BABF-A82ECBC2C8B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.18:beta_1:*:*:*:*:*:*", "matchCriteriaId": "EA045993-D0DE-4878-A9CF-5C671F3E5196", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.18.0:*:*:*:*:*:*:*", "matchCriteriaId": "15426470-3C5F-41AC-B64B-BA021D9F5EA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.18.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "061DD021-3FAA-43D0-9ED2-6E60BF7E6CAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.18.1:*:*:*:*:*:*:*", "matchCriteriaId": "E8B305B8-97DE-45C7-B7A7-B1D1AB32D511", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en MediaWiki V1.17.x anteriores a v1.17.3 y v.18.x anteriores a v1.18.2, permite a atacantes remotos secuestrar la autenticaci\u00f3n de los usuarios con permisos de bloque para peticiones que (1) bloqueen un usuario a trav\u00e9s de una petici\u00f3n al m\u00f3dulo Block o (2) desbloquear un usuario a trav\u00e9s de una petici\u00f3n sobre el m\u00f3dulo Unblock."}], "id": "CVE-2012-1578", "lastModified": "2017-08-29T01:31:19.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2012-09-09T21:55:05.947", "references": [{"source": "secalert@redhat.com", "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.html"}, {"source": "secalert@redhat.com", "url": "http://osvdb.org/80361"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/48504"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/03/22/9"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/03/24/1"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/52689"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=34212"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78911"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}