PT-2019-15809 · Wikimedia · Wikibase Wikidata Query Service Gui

Léa Lacroix · Published 2019-11-27 · Updated 2019-12-18 · CVE-2019-19327

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wikibase Wikidata Query Service GUI versions prior to 0.3.6-SNAPSHOT

Description The issue allows HTML injection when reporting the number of results and number of milliseconds in the ui/ResultView.js file.

Recommendations For versions prior to 0.3.6-SNAPSHOT, update to version 0.3.6-SNAPSHOT or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19327

Affected Products

Wikibase Wikidata Query Service Gui

References · 5

• https://gerrit.wikimedia.org/g/wikidata/query/gui/+/270f833cff8fdc1e050230ecc9f7dfc4d090d90d · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19327 · Vendor Advisory
• https://gerrit.wikimedia.org/r/#/c/553311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19327 · Security Note
• https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001503.html · Vendor Advisory