PT-2014-4920

CVE-2014-2853

Publicado

2014-04-28

Atualizado

2022-05-17

Descrição por

CVSS 2.0

4.3

Média

MétricasAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.21.9 MediaWiki versions 1.22.x prior to 1.22.6

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. This occurs due to insufficient input validation in the includes/actions/InfoAction.php file.

Recommendations For MediaWiki versions prior to 1.21.9, update to version 1.21.9 or later. For MediaWiki versions 1.22.x prior to 1.22.6, update to version 1.22.6 or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados

CVE-2014-2853

GHSA-6H86-9R5G-F2H5

ALT-PU-2014-1960