The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mediawiki | Jul 30, 2024 | Aug 22, 2014 |
| Gentoo Linux | — | Upgrade www-apps/mediawiki. | Oct 30, 2017 | Aug 22, 2014 |
| Mediawiki | — | Upgrade MediaWiki to the latest version | Aug 24, 2017 | Aug 22, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub