PT-2019-16003 · Wikimedia · Mediawiki+2

Suffusion_Of_Yellow · Publicado 2019-12-19 · Atualizado 2019-12-31 · CVE-2019-19910

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.34 through 1.35

Description The issue concerns the MinervaNeue Skin in MediaWiki, where it mishandles certain HTML attributes. This can lead to XSS when using onmouseover within an IMG tag, and it can also disclose the client's IP address when using src=http within an IMG tag. This issue can occur within a talk page topical header viewed in a mobile context using MobileFrontend.

Recommendations For versions 1.34 through 1.35, update to a version that fixes the handling of HTML attributes in the MinervaNeue Skin to prevent XSS and IP address disclosure.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-19910

Produtos afetados

Mediawiki

Minervaneue Skin

Mobilefrontend

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19910 · Nota
• https://osv.dev/vulnerability/CVE-2019-19910 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19910 · Nota de Segurança
• https://phabricator.wikimedia.org/T240487 · Nota
• https://gerrit.wikimedia.org/r/q/Ida471291f1698387a26736931ab17e6899e05b51 · Aviso do Fabricante