Description
The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.
Remediation
References
Related Vulnerabilities
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3427)
WordPress Plugin WooCommerce Quick Reports Cross-Site Scripting (1.0.6)
Ruby on Rails Deserialization of Untrusted Data Vulnerability (CVE-2020-8165)
Django Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0483)
MySQL Improper Input Validation Vulnerability (CVE-2012-5614)