CVE-2015-8622: XSS
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8622?
CVE-2015-8622 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2015-8622?
To fix CVE-2015-8622, upgrade MediaWiki to version 1.23.12, 1.24.5, 1.25.4, or 1.26.1 or later.
Who is affected by CVE-2015-8622?
CVE-2015-8622 affects MediaWiki installations before specified patched versions when configured with a relative URL.
What type of attack does CVE-2015-8622 enable?
CVE-2015-8622 enables remote authenticated users to perform cross-site scripting (XSS) attacks.
What are the versions of MediaWiki vulnerable to CVE-2015-8622?
The vulnerable versions of MediaWiki are 1.23.11 and earlier, 1.24.4 and earlier, 1.25.3 and earlier, and 1.26.0 and earlier.