Secunia

A vulnerability and a security issue have been reported in MediaWiki, which can be exploited by malicious users to disclose sensitive information and bypass certain security restrictions.

1) An error exists within the CSS validation function which can be exploited to disclose potentially sensitive information by displaying external images in wiki pages.

Successful exploitation requires "Editor" permissions to wiki pages.

The vulnerability is reported in versions prior to 1.15.2.

2) The security issue is caused due to a missing user permissions check within the "thumb.php" script. This can be exploited to view restricted images in private wikis.

Success exploitation requires an image access authentication scheme to be configured e.g. via "img_auth.php" script.

The security issue is reported in version 1.5 and later.

Solution
Update to version 1.15.2 or later.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html

Deep Links
Links available in Customer Area