BID:14327

MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability

Info

MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability

Bugtraq ID:	14327
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2005 12:00AM
Updated:	Jul 20 2005 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	MediaWiki MediaWiki 1.4.6 MediaWiki MediaWiki 1.4.5 MediaWiki MediaWiki 1.4.3 MediaWiki MediaWiki 1.4.2 MediaWiki MediaWiki 1.4.1 MediaWiki MediaWiki 1.4 beta6 MediaWiki MediaWiki 1.4 beta5 MediaWiki MediaWiki 1.4 beta4 MediaWiki MediaWiki 1.4 beta3 MediaWiki MediaWiki 1.4 beta2 MediaWiki MediaWiki 1.4 beta1 Gentoo Linux

Not Vulnerable:	MediaWiki MediaWiki 1.4.7

Discussion

MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability

MediaWiki is prone to cross-site scripting attacks.

The specific scripts and parameters that are affected by this issue are currently unknown. This BID will be updated as more details are released.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

MediaWiki 1.4.6 and prior versions are affected.

Exploit / POC

MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability

No exploit is required to leverage this issue.

Solution / Fix

MediaWiki Unspecified Remote Cross-Site Scripting Vulnerability

Solution:
The vendor has released an upgrade to address this issue.

Gentoo has released advisory GLSA 200507-18 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.4.7"

MediaWiki MediaWiki 1.4 beta3