3.5

CVE-2014-7295

The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mediawiki ≫ Mediawiki Version <= 1.19.19
Mediawiki ≫ Mediawiki Version 1.19
Mediawiki ≫ Mediawiki Version 1.19 Update beta_1
Mediawiki ≫ Mediawiki Version 1.19 Update beta_2
Mediawiki ≫ Mediawiki Version 1.19.0
Mediawiki ≫ Mediawiki Version 1.19.1
Mediawiki ≫ Mediawiki Version 1.19.2
Mediawiki ≫ Mediawiki Version 1.19.3
Mediawiki ≫ Mediawiki Version 1.19.4
Mediawiki ≫ Mediawiki Version 1.19.5
Mediawiki ≫ Mediawiki Version 1.19.6
Mediawiki ≫ Mediawiki Version 1.19.7
Mediawiki ≫ Mediawiki Version 1.19.8
Mediawiki ≫ Mediawiki Version 1.19.9
Mediawiki ≫ Mediawiki Version 1.19.10
Mediawiki ≫ Mediawiki Version 1.19.11
Mediawiki ≫ Mediawiki Version 1.19.12
Mediawiki ≫ Mediawiki Version 1.19.13
Mediawiki ≫ Mediawiki Version 1.19.14
Mediawiki ≫ Mediawiki Version 1.19.15
Mediawiki ≫ Mediawiki Version 1.19.16
Mediawiki ≫ Mediawiki Version 1.19.17
Mediawiki ≫ Mediawiki Version 1.19.18
Mediawiki ≫ Mediawiki Version 1.22.0
Mediawiki ≫ Mediawiki Version 1.22.1
Mediawiki ≫ Mediawiki Version 1.22.2
Mediawiki ≫ Mediawiki Version 1.22.3
Mediawiki ≫ Mediawiki Version 1.22.4
Mediawiki ≫ Mediawiki Version 1.22.5
Mediawiki ≫ Mediawiki Version 1.22.6
Mediawiki ≫ Mediawiki Version 1.22.7
Mediawiki ≫ Mediawiki Version 1.22.8
Mediawiki ≫ Mediawiki Version 1.22.9
Mediawiki ≫ Mediawiki Version 1.22.10
Mediawiki ≫ Mediawiki Version 1.22.11
Mediawiki ≫ Mediawiki Version 1.23.0
Mediawiki ≫ Mediawiki Version 1.23.1
Mediawiki ≫ Mediawiki Version 1.23.2
Mediawiki ≫ Mediawiki Version 1.23.3
Mediawiki ≫ Mediawiki Version 1.23.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.57% 0.721
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://seclists.org/oss-sec/2014/q4/67
http://secunia.com/advisories/61752
http://www.debian.org/security/2014/dsa-3046
http://www.securityfocus.com/bid/70238
https://bugzilla.wikimedia.org/show_bug.cgi?id=70672
Patch
https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-October/000163.html