CVEvulnerability
CVE-2012-4378
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-10-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
Affected configurations
• mediawiki mediawiki (<= 1.18.4)
• mediawiki mediawiki 1.19.0
• mediawiki mediawiki 1.19.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2012/08/31/10 Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/6 Mailing List, Patch, Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=853417 Issue Tracking, Patch, Third Party Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T39587 Issue Tracking, Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/10 Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/6 Mailing List, Patch, Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330 Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=853417 Issue Tracking, Patch, Third Party Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T39587 Issue Tracking, Patch, Vendor Advisory