{"api_version":"1","generated_at":"2026-07-23T03:09:33+00:00","cve":"CVE-2012-4378","urls":{"html":"https://cve.report/CVE-2012-4378","api":"https://cve.report/api/cve/CVE-2012-4378.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-4378","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-4378"},"summary":{"title":"CVE-2012-4378","description":"Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.","state":"PUBLISHED","assigner":"redhat","published_at":"2017-10-26 20:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=853417","name":"https://bugzilla.redhat.com/show_bug.cgi?id=853417","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Third Party Advisory"],"title":"853417 – (CVE-2012-4378) CVE-2012-4378 mediawiki: Multiple DOM-based XSS flaws due improper filtering of uselang parameter","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/08/31/10","name":"http://www.openwall.com/lists/oss-security/2012/08/31/10","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"],"title":"oss-security - Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple\n security flaws","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html","name":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"[MediaWiki-announce] MediaWiki security release: 1.19.2 and 1.18.5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2012/08/31/6","name":"http://www.openwall.com/lists/oss-security/2012/08/31/6","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"],"title":"oss-security - CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330","name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"#686330 - mediawiki: Multiple security issues CVE-2012-4377,CVE-2012-4378,CVE-2012-4379,CVE-2012-4380,CVE-2012-4381,CVE-2012-4382 - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://phabricator.wikimedia.org/T39587","name":"https://phabricator.wikimedia.org/T39587","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"],"title":"⚓ T39587 character filter for uselang","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4378","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4378","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"4378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.19.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"4378","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.19.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"4378","vulnerable":"1","versionEndIncluding":"1.18.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T20:35:08.931Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/08/31/6"},{"name":"[MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=853417"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://phabricator.wikimedia.org/T39587"},{"name":"[oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2012/08/31/10"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-08-31T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-26T19:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/08/31/6"},{"name":"[MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=853417"},{"tags":["x_refsource_CONFIRM"],"url":"https://phabricator.wikimedia.org/T39587"},{"name":"[oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2012/08/31/10"},{"tags":["x_refsource_MISC"],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2012-4378","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[oss-security] 20120831 CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/08/31/6"},{"name":"[MediaWiki-announce] 20120831 MediaWiki security release: 1.19.2 and 1.18.5","refsource":"MLIST","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=853417","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=853417"},{"name":"https://phabricator.wikimedia.org/T39587","refsource":"CONFIRM","url":"https://phabricator.wikimedia.org/T39587"},{"name":"[oss-security] 20120831 Re: CVE Request -- MediaWiki 1.19.2 and 1.18.5 multiple security flaws","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2012/08/31/10"},{"name":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330","refsource":"MISC","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-4378","datePublished":"2017-10-26T20:00:00.000Z","dateReserved":"2012-08-21T00:00:00.000Z","dateUpdated":"2024-08-06T20:35:08.931Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-26 20:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionEndIncluding":"1.18.4","matchCriteriaId":"B03517F3-5555-4DCF-A5BD-15B2AF03C970"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*","matchCriteriaId":"A7C29D44-2964-483F-B672-27B5CE471DA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*","matchCriteriaId":"172FEFE5-9900-49D0-9E14-2FA4A7912D23"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"4378","Ordinal":"1","Title":"CVE-2012-4378","CVE":"CVE-2012-4378","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"4378","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.","Type":"Description","Title":"CVE-2012-4378"},{"CveYear":"2012","CveId":"4378","Ordinal":"2","NoteData":"2017-10-26","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"4378","Ordinal":"3","NoteData":"2017-10-26","Type":"Other","Title":"Modified"}]}}}