CVE-2007-0177
Summary
| CVE | CVE-2007-0177 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-01-11 00:28:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
Risk And Classification
Primary CVSS: v2.0 5.1 from [email protected]
AV:N/AC:H/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mediawiki | Mediawiki | 1.6.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.5_r14348 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.6.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.7.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.7.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.8.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.9.0 | rc2 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SUSE Update for Multiple Packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Page not found - SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Patch, Vendor Advisory |
| Query: Active Repositories | af854a3a-2127-422b-91ae-364da2661108 | svn.wikimedia.org | Patch, Vendor Advisory |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| attribute in uploaded files bearing the image/svg MIME type. Disabled by default due to the vast majority of web servers being hideously misconfigured. See DefaultSettings.php for more details. * Changed default LocalSettings.php to append the previous include path when setting it * (bug 5837) Use "members" for the value descriptor in Special:Categories, Special:Wantedcategories and Special:Mostlinkedcategories. * (bug 3309) Allow comments when undeleting pages * Clean up Special:Undelete a bit * (bu | af854a3a-2127-422b-91ae-364da2661108 | svn.wikimedia.org | Patch, Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| osvdb.org/31525 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| MediaWiki AJAX "rs" Cross-Site Scripting - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| MediaWiki AJAX Index.PHP Cross-Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch, Vendor Advisory |
| Query: Hosted in Phabricator | af854a3a-2127-422b-91ae-364da2661108 | svn.wikimedia.org | Patch, Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Query: Active Repositories | af854a3a-2127-422b-91ae-364da2661108 | svn.wikimedia.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.