PT-2008-2092 · Wikimedia Foundation+1 · Mediawiki+2

Brion Vibber · Published 2008-01-25 · Updated 2021-07-23 · CVE-2008-0460

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.11.0rc1 and earlier, specifically versions 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8 MediaWiki BotQuery extension for MediaWiki 1.7 and earlier

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors when Internet Explorer is used.

Recommendations For MediaWiki versions 1.11 through 1.11.0rc1, update to a version later than 1.11.0rc1. For MediaWiki versions 1.10 through 1.10.2, update to a version later than 1.10.2. For MediaWiki versions 1.9 through 1.9.4, update to a version later than 1.9.4. For MediaWiki version 1.8, update to a version later than 1.8. For the BotQuery extension in MediaWiki 1.7 and earlier, consider disabling the extension until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0460

Affected Products

Internet Explorer

Mediawiki

Mediawiki Botquery Extension

References · 13

• https://osv.dev/vulnerability/CVE-2008-0460 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0460 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00189.html · Vendor Advisory
• http://secunia.com/advisories/28629 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0460 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00147.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0460 · Security Note
• http://vupen.com/english/advisories/2008/0280 · Note
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-January/000068.html · Note
• http://secunia.com/advisories/29266 · Note
• http://securityfocus.com/bid/28137 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39901 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0460 · Note