CVE-2012-4378: XSS
First published: Thu Oct 26 2017(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/mediawiki | 1:1.31.16-1+deb10u2 1:1.31.16-1+deb10u6 1:1.35.11-1~deb11u1 1:1.35.13-1~deb11u1 1:1.39.4-1~deb12u1 1:1.39.5-1~deb12u1 1:1.39.5-1 | |
| MediaWiki | <=1.18.4 | |
| MediaWiki | =1.19.0 | |
| MediaWiki | =1.19.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.wikimedia.org/show_bug.cgi?id=37587
- https://www.openwall.com/lists/oss-security/2012/08/31/6
- https://security-tracker.debian.org/tracker/CVE-2012-4378
- http://www.openwall.com/lists/oss-security/2012/08/31/10
- http://www.openwall.com/lists/oss-security/2012/08/31/6
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330
- https://bugzilla.redhat.com/show_bug.cgi?id=853417
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html
- https://phabricator.wikimedia.org/T39587
Frequently Asked Questions
What is the severity of CVE-2012-4378?
CVE-2012-4378 is classified as a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-4378?
To fix CVE-2012-4378, update MediaWiki to version 1.18.5 or later, or 1.19.2 or later.
What types of attacks can be performed using CVE-2012-4378?
CVE-2012-4378 allows attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
Which versions of MediaWiki are affected by CVE-2012-4378?
CVE-2012-4378 affects MediaWiki versions prior to 1.18.5 and the 1.19.x versions prior to 1.19.2.
Is authentication required to exploit CVE-2012-4378?
No, CVE-2012-4378 can be exploited by unauthenticated remote attackers.
- collector/security-tracker-debian
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/remedy
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/mediawiki
- canonical/mediawiki
- version/mediawiki/1.18.4
- version/mediawiki/1.19.0
- version/mediawiki/1.19.1