CVE-2007-4828: XSS
Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Other sources
Secunia published security advisory for mediawiki:
http://secunia.com/advisories/26772/
A vulnerability has been reported in MediaWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to unspecified parameters in the API pretty-printing mode is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Successful exploitation requires that the API interface is enabled.
The vulnerability is reported in the following versions: 1.11 <= 1.11.0rc1 1.10 <= 1.10.1 1.9 <= 1.9.3 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on)
Solution: Update to version 1.11.0, 1.10.2, 1.9.4, or 1.8.5.
Versions currently in Fedora falls into "affected" range, even though there is following note in changelog for release 1.9.3-34:
- Update to 1.9.4.
It only seems to be typo. If there's any other reason why Fedora packages are not affected, feel free to close this bug with appropriate comment.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Is manual patching required for CVE-2007-4828?
No, manual patching is not required; the best remediation is to upgrade to a patched version of MediaWiki.