CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
98.8%
(T109140) (T122209) Special:UserLogin and Special:Search allow redirect to interwiki links. (CVE-2017-0363, CVE-2017-0364)
(T144845) XSS in SearchHighlighter::highlightText() when $wgAdvancedSearchHighlighting is true. (CVE-2017-0365)
(T125177) API parameters may now be marked as ‘sensitive’ to keep their values out of the logs.
(CVE-2017-0361)
(T150044) ‘Mark all pages visited’ on the watchlist now requires a CSRF token. (CVE-2017-0362)
(T156184) Escape content model/format url parameter in message. (CVE-2017-0368)
(T151735) SVG filter evasion using default attribute values in DTD declaration. (CVE-2017-0366)
(T48143) Spam blacklist ineffective on encoded URLs inside file inclusion syntax’s link parameter.
(CVE-2017-0370)
(T108138) Sysops can undelete pages, although the page is protected against it. (CVE-2017-0369)
The following only affects 1.27 and above and is not included in the 1.23 upgrade :
The following fix is for the SyntaxHighlight extension :
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Fedora Security Advisory FEDORA-2017-3fb95ed01f.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(99408);
script_version("3.10");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/11");
script_cve_id("CVE-2017-0361", "CVE-2017-0362", "CVE-2017-0363", "CVE-2017-0364", "CVE-2017-0365", "CVE-2017-0366", "CVE-2017-0367", "CVE-2017-0368", "CVE-2017-0369", "CVE-2017-0370", "CVE-2017-0372");
script_xref(name:"FEDORA", value:"2017-3fb95ed01f");
script_name(english:"Fedora 25 : mediawiki (2017-3fb95ed01f)");
script_summary(english:"Checks rpm output for the updated package.");
script_set_attribute(
attribute:"synopsis",
value:"The remote Fedora host is missing a security update."
);
script_set_attribute(
attribute:"description",
value:
" - (T109140) (T122209) Special:UserLogin and Special:Search
allow redirect to interwiki links. (CVE-2017-0363,
CVE-2017-0364)
- (T144845) XSS in SearchHighlighter::highlightText() when
$wgAdvancedSearchHighlighting is true. (CVE-2017-0365)
- (T125177) API parameters may now be marked as
'sensitive' to keep their values out of the logs.
(CVE-2017-0361)
- (T150044) 'Mark all pages visited' on the watchlist now
requires a CSRF token. (CVE-2017-0362)
- (T156184) Escape content model/format url parameter in
message. (CVE-2017-0368)
- (T151735) SVG filter evasion using default attribute
values in DTD declaration. (CVE-2017-0366)
- (T48143) Spam blacklist ineffective on encoded URLs
inside file inclusion syntax's link parameter.
(CVE-2017-0370)
- (T108138) Sysops can undelete pages, although the page
is protected against it. (CVE-2017-0369)
The following only affects 1.27 and above and is not included in the
1.23 upgrade :
- (T161453) LocalisationCache will no longer use the
temporary directory in its fallback chain when trying to
work out where to write the cache. (CVE-2017-0367)
The following fix is for the SyntaxHighlight extension :
- (T158689) Parameters injection in SyntaxHighlight
results in multiple vulnerabilities. (CVE-2017-0372)
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fb95ed01f"
);
script_set_attribute(
attribute:"solution",
value:"Update the affected mediawiki package."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'MediaWiki SyntaxHighlight extension option injection vulnerability');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mediawiki");
script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/13");
script_set_attribute(attribute:"patch_publication_date", value:"2017/04/15");
script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/17");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Fedora Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^25([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
flag = 0;
if (rpm_check(release:"FC25", reference:"mediawiki-1.27.2-1.fc25")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mediawiki");
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0361
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0362
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0363
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0364
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0365
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0366
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0367
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0368
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0369
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0370
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0372
bodhi.fedoraproject.org/updates/FEDORA-2017-3fb95ed01f
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
98.8%