CVEvulnerability
CVE-2015-2941
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-04-13
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Affected configurations
• mediawiki mediawiki (<= 1.19.23)
• mediawiki mediawiki 1.20
• mediawiki mediawiki 1.20.1
• mediawiki mediawiki 1.20.2
• mediawiki mediawiki 1.20.3
• mediawiki mediawiki 1.20.4
• mediawiki mediawiki 1.20.5
• mediawiki mediawiki 1.20.6
• mediawiki mediawiki 1.20.7
• mediawiki mediawiki 1.20.8
• mediawiki mediawiki 1.21
• mediawiki mediawiki 1.21.1
• mediawiki mediawiki 1.21.2
• mediawiki mediawiki 1.21.3
• mediawiki mediawiki 1.21.4
• mediawiki mediawiki 1.21.5
• mediawiki mediawiki 1.21.6
• mediawiki mediawiki 1.21.7
• mediawiki mediawiki 1.21.8
• mediawiki mediawiki 1.21.9
• mediawiki mediawiki 1.21.10
• mediawiki mediawiki 1.21.11
• mediawiki mediawiki 1.22.0
• mediawiki mediawiki 1.22.1
• mediawiki mediawiki 1.22.2
• mediawiki mediawiki 1.22.3
• mediawiki mediawiki 1.22.4
• mediawiki mediawiki 1.22.5
• mediawiki mediawiki 1.22.6
• mediawiki mediawiki 1.22.7
• mediawiki mediawiki 1.22.8
• mediawiki mediawiki 1.22.9
• mediawiki mediawiki 1.22.10
• mediawiki mediawiki 1.22.11
• mediawiki mediawiki 1.22.12
• mediawiki mediawiki 1.22.13
• mediawiki mediawiki 1.22.14
• mediawiki mediawiki 1.22.15
• mediawiki mediawiki 1.23.0
• mediawiki mediawiki 1.23.1
• mediawiki mediawiki 1.23.2
• mediawiki mediawiki 1.23.3
• mediawiki mediawiki 1.23.4
• mediawiki mediawiki 1.23.5
• mediawiki mediawiki 1.23.6
• mediawiki mediawiki 1.23.7
• mediawiki mediawiki 1.23.8
• mediawiki mediawiki 1.24.0
• mediawiki mediawiki 1.24.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.openwall.com/lists/oss-security/2015/04/01/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/04/07/3 www.openwall.com
- http://www.securityfocus.com/bid/73477 www.securityfocus.com
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T85851 Exploit
- https://security.gentoo.org/glsa/201510-05 security.gentoo.org
- http://www.openwall.com/lists/oss-security/2015/04/01/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/04/07/3 www.openwall.com
- http://www.securityfocus.com/bid/73477 www.securityfocus.com
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T85851 Exploit
- https://security.gentoo.org/glsa/201510-05 security.gentoo.org