4.3

CVE-2006-2611

Exploit

EPSS 1.41%
Veröffentlicht 26.05.2006 01:06:00
Zuletzt bearbeitet 03.04.2025 01:03:51
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 13

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mediawiki ≫ Mediawiki Version <= 1.6.5_r14348

Mediawiki ≫ Mediawiki Version1.6.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.41%	0.797

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

http://bugzilla.wikimedia.org/show_bug.cgi?id=6055

Patch

Exploit

http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035812.html

Exploit

http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035814.html

Patch

http://nickj.org/MediaWiki

http://secunia.com/advisories/20189

Patch

Vendor Advisory

http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349

Patch

http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349

Patch

http://www.osvdb.org/25713

http://www.vupen.com/english/advisories/2006/1926

https://exchange.xforce.ibmcloud.com/vulnerabilities/26646

https://nvd.nist.gov/vuln/detail/CVE-2006-2611

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2006-2611

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2006-2611

EUVD