CVE-2006-2611: XSS
First published: Fri May 26 2006(Updated: )
Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MediaWiki MediaWiki | <=1.6.5_r14348 | |
| MediaWiki MediaWiki | =1.6.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035812.html
- http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035814.html
- http://bugzilla.wikimedia.org/show_bug.cgi?id=6055
- http://nickj.org/MediaWiki
- http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349
- http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349
- http://secunia.com/advisories/20189
- http://www.osvdb.org/25713
- http://www.vupen.com/english/advisories/2006/1926
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26646
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/tags
- collector/nvd-historical
- vendor/mediawiki
- product/mediawiki
- canonical/mediawiki mediawiki
- agent/software-canonical-lookup-request
- collector/nvd-index
- version/mediawiki mediawiki/1.6.5_r14348
- version/mediawiki mediawiki/1.6.5