CVE-2019-19329: XSS
In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19329?
CVE-2019-19329 is classified as a medium severity vulnerability due to the potential for arbitrary JavaScript execution.
How do I fix CVE-2019-19329?
To fix CVE-2019-19329, upgrade to the patched version 0.3.6 or later of the Wikimedia Wikidata Query Service GUI.
What type of vulnerability is CVE-2019-19329?
CVE-2019-19329 is a cross-site scripting (XSS) vulnerability that occurs when mathematical expressions are processed without proper sanitization.
Which versions of the software are affected by CVE-2019-19329?
CVE-2019-19329 affects versions of the Wikimedia Wikidata Query GUI up to and including 0.3.5 and version 0.3.6 prior to the 2019-11-07 release.
What was introduced to mitigate CVE-2019-19329?
MathJax was introduced as a new mathematics rendering engine to mitigate the XSS vulnerability in CVE-2019-19329.