Description
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.15.5-2 | — |
| Debian 13 | mediawiki | 1:1.15.5-2 | — |
| Debian 12 | mediawiki | 1:1.15.5-2 | — |
| Debian 6.0 | mediawiki | 1:1.15.5-2 | DTSA-207-1 |
Advisories 1
- DTSA-207-1 mediawiki - clickjacking Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110104 Re: (possible) CVE request: Clickjacking in Mediawiki mailing-list
- ADV-2011-0017 vdb-entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=26561
- 70272 vdb-entry
- FEDORA-2011-5807 vendor-advisory
- [MediaWiki-announce] 20110104 MediaWiki security release 1.16.1 mailing-list
- [oss-security] 20110104 (possible) CVE request: Clickjacking in Mediawiki mailing-list
- 42810 third-party-advisory
- FEDORA-2011-5848 vendor-advisory
- mediawiki-frames-clickjacking(64476) vdb-entry
- FEDORA-2011-5812 vendor-advisory