CVE Vulnerability

CVE-2007-1055

Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter. NOTE: this issue might be a duplicate of CVE-2007-0177.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

References
Link Resource
http://www.bugsec.com/articles.php?Security=24 Broken Link Third Party Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0/phase3/RELEASE-NOTES Third Party Advisory
http://securityreason.com/securityalert/2274 Exploit Third Party Advisory
http://osvdb.org/37343 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/32586 Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/460596/100/0/threaded Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
cpe:2.3:a:mediawiki:mediawiki:1.9.0:rc1:*:*:*:*:*:*
Information

Published : 2007-02-21 11:28

Updated : 2018-10-19 06:08

NVD link : CVE-2007-1055

Mitre link : CVE-2007-1055

Products Affected
No products.
CWE
CWE-94