Description
The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.
Remediation
References
Related Vulnerabilities
Craft CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-14280)
IBM WebSEAL Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2020-4699)
WordPress Plugin Add From Server Cross-Site Request Forgery (3.3.1)
WordPress 3.9.x Cross-Domain Flash Injection Vulnerability (3.9 - 3.9.22)
Drupal Improper Input Validation Vulnerability (CVE-2014-5019)