PT-2019-16003 · Wikimedia · Mediawiki+2

Suffusion_Of_Yellow · Published 2019-12-19 · Updated 2019-12-31 · CVE-2019-19910

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.34 through 1.35

Description The issue concerns the MinervaNeue Skin in MediaWiki, where it mishandles certain HTML attributes. This can lead to XSS when using onmouseover within an IMG tag, and it can also disclose the client's IP address when using src=http within an IMG tag. This issue can occur within a talk page topical header viewed in a mobile context using MobileFrontend.

Recommendations For versions 1.34 through 1.35, update to a version that fixes the handling of HTML attributes in the MinervaNeue Skin to prevent XSS and IP address disclosure.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19910

Affected Products

Mediawiki

Minervaneue Skin

Mobilefrontend

References · 5

• https://osv.dev/vulnerability/CVE-2019-19910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19910 · Security Note
• https://gerrit.wikimedia.org/r/q/Ida471291f1698387a26736931ab17e6899e05b51 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19910 · Note
• https://phabricator.wikimedia.org/T240487 · Note