MediaWiki up to 1.19.17/1.22.8/1.23.1 cross site scripting

Summaryinfo

A vulnerability categorized as problematic has been discovered in MediaWiki up to 1.19.17/1.22.8/1.23.1. Affected is an unknown function. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in MediaWiki up to 1.19.17/1.22.8/1.23.1 (Content Management System). It has been declared as problematic. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity.

The weakness was shared 07/30/2014 as Bug 66608 / MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2 as confirmed posting (Mailing List). The advisory is shared for download at lists.wikimedia.org. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 1.23.2, 1.22.9 or 1.19.18 eliminates this vulnerability. The upgrade is hosted for download at releases.wikimedia.org. Applying a patch is able to eliminate this problem. The bugfix is ready for download at releases.wikimedia.org. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1030660†). The entries VDB-67265 and VDB-67263 are related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Name

• MediaWiki

Version

• 1.19.0
• 1.19.1
• 1.19.2
• 1.19.3
• 1.19.4
• 1.19.5
• 1.19.6
• 1.19.7
• 1.19.8
• 1.19.9
• 1.19.10
• 1.19.11
• 1.19.12
• 1.19.13
• 1.19.14
• 1.19.15
• 1.19.16
• 1.19.17
• 1.22.0
• 1.22.1
• 1.22.2
• 1.22.3
• 1.22.4
• 1.22.5
• 1.22.6
• 1.22.7
• 1.22.8
• 1.23.0
• 1.23.1

License

• open-source

Website

• Product: https://www.mediawiki.org/wiki/MediaWiki

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion