CVE-2011-1765: XSS
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.
Other sources
Mediawiki 1.16.5 was released [1] to correct two security flaws:
The first issue is yet another recurrence of the Internet Explorer 6 XSS vulnerability that caused the release of 1.16.4. It was pointed out that there are dangerous extensions with more than four characters, so the regular expressions we introduced had to be updated to match longer extensions. (CVE-2011-1765)
For more details, see https://bugzilla.wikimedia.org/showbug.cgi?id=28534
The second issue allows unauthenticated users to gain additional rights, on wikis where $wgBlockDisablesLogin is enabled. By default, it is disabled. The issue occurs when a malicious user sends cookies which contain the user name and user ID of a "victim" account. In certain circumstances, the rights of the victim are loaded and persist throughout the malicious request, allowing the malicious user to perform actions with the victim's rights. (CVE-2011-1766)
$wgBlockDisablesLogin is a feature which is sometimes used on private wikis to prevent users who have an account from logging in and viewing content on the wiki.
For more details, see https://bugzilla.wikimedia.org/showbug.cgi?id=28639
[1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1765?
CVE-2011-1765 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2011-1765?
To fix CVE-2011-1765, upgrade to MediaWiki version 1.16.5 or later.
What versions are affected by CVE-2011-1765?
CVE-2011-1765 affects MediaWiki versions prior to 1.16.5.
What types of attacks can be performed using CVE-2011-1765?
CVE-2011-1765 can be exploited to perform cross-site scripting (XSS) attacks.
Is CVE-2011-1765 specific to any web browsers?
Yes, CVE-2011-1765 specifically affects MediaWiki when used with Internet Explorer 6 or earlier.