Description
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.15.5-1 | — |
| Debian 13 | mediawiki | 1:1.15.5-1 | — |
| Debian 12 | mediawiki | 1:1.15.5-1 | — |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=620225
- FEDORA-2011-5495 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=620226
- FEDORA-2011-5807 vendor-advisory
- [oss-security] 20100729 Re: CVE request: mediawiki mailing-list
- 42024 vdb-entry
- FEDORA-2011-5848 vendor-advisory
- [mediawiki-announce] 20100728 MediaWiki security release: 1.16.0 and 1.15.5 mailing-list
- http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952
- FEDORA-2011-5812 vendor-advisory
- http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984