Cross-site scripting in MediaWiki - CVE-2015-2932
Published: April 13, 2015 / Updated: August 9, 2020
Vulnerability identifier: #VU40836
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-2932
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
Affected software
MediaWiki
How to mitigate CVE-2015-2932
Install update from vendor's website.
External References
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:200
- http://www.openwall.com/lists/oss-security/2015/04/01/1
- http://www.openwall.com/lists/oss-security/2015/04/07/3
- http://www.securityfocus.com/bid/73477
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
- https://phabricator.wikimedia.org/T86711
- https://security.gentoo.org/glsa/201510-05