PT-2012-6278 · Mediawiki · Mediawiki Rss Reader Extension

Thorsten Glaser · Published 2012-12-31 · Updated 2012-12-31 · CVE-2012-6453

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki RSS Reader extension versions prior to 0.2.6

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via a crafted feed.

Recommendations For versions prior to 0.2.6, update to version 0.2.6 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-6453

DSA-2596-1

Affected Products

Mediawiki Rss Reader Extension

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-6453 · Security Note
• http://bugs.debian.org/696179 · Note
• http://mediawiki.org/wiki/Extension:RSS_Reader#0.2.6 · Note