CVE-2007-4828

Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published Bysecalert@redhat.com

Published DateSep 12, 2007, 19:17

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://fedoranews.org/updates/FEDORA-2007-218.shtml
http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html
http://secunia.com/advisories/26772
http://secunia.com/advisories/26870
http://www.securityfocus.com/bid/25632
http://www.vupen.com/english/advisories/2007/3130
https://bugzilla.redhat.com/show_bug.cgi?id=287881
https://exchange.xforce.ibmcloud.com/vulnerabilities/36558

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE