CVE-2008-5252

NameCVE-2008-5252
DescriptionCross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1901-1, DTSA-186-1
NVD severitymedium
Debian Bugs508870

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mediawiki (PTS)stretch1:1.27.7-1~deb9u3fixed
stretch (security)1:1.27.7-1~deb9u5fixed
buster1:1.31.7-1~deb10u1fixed
buster (security)1:1.31.10-1~deb10u1fixed
bullseye, sid1:1.35.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mediawikisourceetch(not affected)
mediawikisourcelenny1:1.12.0-2lenny2DTSA-186-1
mediawikisource(unstable)1:1.13.3-1508870
mediawiki1.7sourceetch1.7.1-9etch1DSA-1901-1
mediawiki1.7source(unstable)(unfixed)

Notes

[etch] - mediawiki <not-affected> (metapackage)

Search for package or bug name: Reporting problems