CVE-2014-5241: Cross-Site Request Forgery (CSRF)

The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site...

PT-2014-6359

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.18 MediaWiki versions 1.20.x through 1.22.x before 1.22.9 MediaWiki versions 1.23.x before 1.23.2 Description The issue concerns the JSONP endpoint in MediaWiki, which does not properly restrict certain long...