Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2014-5241 - Vulnerability Database
MediaWiki

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2014-5241

Medium
Reference: CVE-2014-5241
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2014-5241
Title: MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability
Overview:

The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18 1.20.x through 1.22.x before 1.22.9 and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and obtain sensitive information via a crafted OBJECT element with SWF content consistent with a restricted character set.