CVEvulnerability
CVE-2016-6333
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-04-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.
Affected configurations
• mediawiki mediawiki (<= 1.23.14)
• mediawiki mediawiki 1.26.0
• mediawiki mediawiki 1.26.1
• mediawiki mediawiki 1.26.2
• mediawiki mediawiki 1.26.3
• mediawiki mediawiki 1.26.4
• mediawiki mediawiki 1.27.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.securityfocus.com/bid/98053 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613 Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html Mailing List, Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T133147 Patch, Third Party Advisory
- http://www.securityfocus.com/bid/98053 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613 Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html Mailing List, Patch, Vendor Advisory
- https://phabricator.wikimedia.org/T133147 Patch, Third Party Advisory