PT-2008-2092 · Wikimedia Foundation+1 · Mediawiki+2

Brion Vibber · Publicado 2008-01-25 · Atualizado 2021-07-23 · CVE-2008-0460

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.11.0rc1 and earlier, specifically versions 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8 MediaWiki BotQuery extension for MediaWiki 1.7 and earlier

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when Internet Explorer is used.

Recommendations For MediaWiki versions 1.11 through 1.11.0rc1, update to a version later than 1.11.0rc1. For MediaWiki versions 1.10 through 1.10.2, update to a version later than 1.10.2. For MediaWiki versions 1.9 through 1.9.4, update to a version later than 1.9.4. For MediaWiki version 1.8, update to a version later than 1.8. For the BotQuery extension in MediaWiki 1.7 and earlier, consider disabling the extension until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0460

Produtos afetados

Internet Explorer

Mediawiki

Mediawiki Botquery Extension

Referências · 13

• https://osv.dev/vulnerability/CVE-2008-0460 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0280 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-0460 · Aviso do Fabricante
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-January/000068.html · Nota
• http://secunia.com/advisories/29266 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00189.html · Aviso do Fabricante
• http://secunia.com/advisories/28629 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0460 · Aviso do Fabricante
• http://securityfocus.com/bid/28137 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00147.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39901 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0460 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0460 · Nota de Segurança