PT-2019-4689 · Mediawiki · Mediawiki Mobilefrontend Extension

Xiplus · Published 2019-08-09 · Updated 2019-09-25 · CVE-2019-14807

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki MobileFrontend extension versions 1.31 through 1.33

Description The issue is related to a lack of protection measures for the web page structure in the MobileFrontend extension for MediaWiki, specifically within the includes/specials/MobileSpecialPageFeed.php component. This allows for cross-site scripting (XSS) attacks, which can be exploited by a remote attacker to perform malicious actions. The XSS exists within the edit summary field.

Recommendations For MediaWiki MobileFrontend extension versions 1.31 through 1.33, consider disabling the edit summary field in the includes/specials/MobileSpecialPageFeed.php component until a patch is available. Restrict access to this component to minimize the risk of exploitation. Avoid using the edit summary field in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01061

CVE-2019-14807

Affected Products

Mediawiki Mobilefrontend Extension

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-14807 · Security Note
• https://phabricator.wikimedia.org/T229541 · Patch
• https://osv.dev/vulnerability/CVE-2019-14807 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01061 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-14807 · Note
• https://gerrit.wikimedia.org/g/mediawiki/extensions/MobileFrontend/+/08dfc59771d0ed9b739a59bb521baf7f59d169f9 · Note
• https://vuldb.com/?id.139768 · Note