CVE-2015-2939: XSS

Published Apr 13, 2015

Updated

Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.

Affected Software

1 affected component

MediaWiki Scribunto Mediawiki

Remediation

Patch Available

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

Event History

Apr 13, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2939?

CVE-2015-2939 has a medium severity rating due to the potential for remote code execution via XSS attacks.

How do I fix CVE-2015-2939?

To fix CVE-2015-2939, update to the latest version of the Scribunto extension for MediaWiki where the vulnerability is patched.

Who is affected by CVE-2015-2939?

CVE-2015-2939 affects installations of MediaWiki that utilize the Scribunto extension.

What type of attack does CVE-2015-2939 facilitate?

CVE-2015-2939 facilitates cross-site scripting (XSS) attacks by allowing remote attackers to inject arbitrary scripts.

Is CVE-2015-2939 easy to exploit?

CVE-2015-2939 can be considered easy to exploit for attackers who can manipulate Lua function names through the vulnerability.