Change Details

= T178451: XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T178451 = T128209: Reflected File Download from api.php = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T128209 = T165846: BotPasswords doesn't throttle login attempts = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 == Reference == https://phabricator.wikimedia.org/T165846 = T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T134100 = T176247: It's possible to mangle HTML via raw message parameter expansion = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T176247

= T178451: XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping = == Flaw == Potential XSS when `$wgShowExceptionDetails = false;` is set and an exception is encountered depending on client used. == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T178451 = T128209: Reflected File Download from api.php = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T128209 = T165846: BotPasswords doesn't throttle login attempts = == Flaw == When logging in using a Bot Password, users login are not limited. == Exploit == A malicious user can repeatedly try to login via the api using a Bot Password, ignoring any warnings without any restrictions, making guessing passwords a lot easier. With the throttle in place, users are limited in the number of login attempts in a period of time. == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branch 1.28.x == Reference == https://phabricator.wikimedia.org/T165846 = T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T134100 = T176247: It's possible to mangle HTML via raw message parameter expansion = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T176247

= T178451: XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping = == Flaw == Potential XSS when `$wgShowExceptionDetails = false;` is set and an exception is encountered depending on client used. == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T178451 = T128209: Reflected File Download from api.php = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T128209 = T165846: BotPasswords doesn't throttle login attempts = == Flaw == When logging in using a Bot Password, users login are not limited. == Exploit == A malicious user can repeatedly try to login via the api using a Bot Password, ignoring any warnings without any restrictions, making guessing passwords a lot easier. With the throttle in place, users are limited in the number of login attempts in a period of time. == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branch 1.28.x == Reference == https://phabricator.wikimedia.org/T165846 = T134100: On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T134100 = T176247: It's possible to mangle HTML via raw message parameter expansion = == Flaw == == Exploit == == Affects == MediaWiki versions 1.29.x prior to 1.29.2 1.27.x prior to 1.27.4 and unsupported branches 1.21.x, 1.22.x, 1.24.x, 1.25.x, 1.26.x, 1.28.x == Reference == https://phabricator.wikimedia.org/T176247