CVE-2017-0365: XSS in SearchHighlighter::highlightText() [requires non-default config]
Published Apr 13, 2018
·Updated
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations.
Affected Software
5 affected componentsFixes available
MediaWiki MediaWiki>=1.23.0<=1.23.16
MediaWiki MediaWiki>=1.27.0<1.27.2
MediaWiki MediaWiki>=1.28.0<1.28.1
Debian Debian Linux=7.0
debian/mediawiki
1:1.35.13-1+deb11u21:1.35.13-1+deb11u61:1.39.17-1~deb12u11:1.43.6+dfsg-1~deb13u11:1.43.6+dfsg-2
Event History
Apr 13, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
DescriptionWeakness
Feb 19, 2026
Data Sourced
via Debian·07:26 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-0365?
CVE-2017-0365 is classified as a medium severity XSS vulnerability affecting certain versions of MediaWiki.
2
How do I fix CVE-2017-0365?
To mitigate CVE-2017-0365, upgrade MediaWiki to version 1.28.1 or later, 1.27.2 or later, or 1.23.16 or later.
3
What versions of MediaWiki are affected by CVE-2017-0365?
CVE-2017-0365 affects MediaWiki versions prior to 1.28.1, 1.27.2, and 1.23.16.
4
Is CVE-2017-0365 a serious threat to my MediaWiki installation?
Yes, CVE-2017-0365 can be a serious threat if left unaddressed, as it allows for XSS attacks.
5
Are there any non-default configurations affected in CVE-2017-0365?
Yes, the XSS vulnerability in CVE-2017-0365 is present specifically with non-default configurations in MediaWiki.