6.8

CVE-2007-1055

Exploit
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.  NOTE: this issue might be a duplicate of CVE-2007-0177.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mediawiki ≫ Mediawiki Version <= 1.8.2
Mediawiki ≫ Mediawiki Version1.9.0 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.07% 0.79
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://securityreason.com/securityalert/2274
Third Party Advisory
Exploit
http://www.bugsec.com/articles.php?Security=24
Third Party Advisory
Broken Link
http://www.securityfocus.com/archive/1/460596/100/0/threaded
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32586
Third Party Advisory
VDB Entry
http://osvdb.org/37343
Broken Link
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0/phase3/RELEASE-NOTES
Third Party Advisory