MediaWiki api. php script Information Leakage vulnerability and repair

Affected Versions:

MediaWiki 1.8-1.15.4

Vulnerability description:

MediaWiki is a famous wiki program running in the PHP + MySQL environment. The MediaWiki api. php script does not correctly enforce the Cache-Control header for cached data. Remote attackers can exploit this vulnerability to publicly Cache data.

Header requests are confidential data, including the title and content of the article, the content of the deleted article, the user email address, or the watchlist. Successful attack requirements

Attackers can use the same HTTP Proxy Server as the victim.

<* Reference

Http://secunia.com/advisories/40740/
Https://bugzilla.wikimedia.org/show_bug.cgi? Format = multiple & amp; id = 24565

*>

Vendor patch: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html