CVE-2019-19708: XSS

Q: What is the severity of CVE-2019-19708?

CVE-2019-19708 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2019-19708?

To fix CVE-2019-19708, upgrade the VisualEditor extension to version 1.35 or later.

Q: What is the impact of CVE-2019-19708?

The impact of CVE-2019-19708 is that it allows attackers to execute arbitrary JavaScript in the context of a user's session, leading to data theft or manipulation.

Q: Which versions of MediaWiki are affected by CVE-2019-19708?

CVE-2019-19708 affects all versions of the VisualEditor extension for MediaWiki up to and including 1.34.

Q: Is there a workaround for CVE-2019-19708?

A workaround for CVE-2019-19708 is to disable the VisualEditor extension to prevent potential XSS attacks until an upgrade can be performed.

Published Dec 11, 2019

Updated

The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.

Affected Software

1 affected component

MediaWiki Visual Editor Mediawiki<=1.34

Event History

Dec 11, 2019

CVE Published

via MITRE·01:33 AM

Data Sourced

via MITRE·01:33 AM

Description

Frequently Asked Questions

What is the severity of CVE-2019-19708?

CVE-2019-19708 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2019-19708?

To fix CVE-2019-19708, upgrade the VisualEditor extension to version 1.35 or later.

What is the impact of CVE-2019-19708?

The impact of CVE-2019-19708 is that it allows attackers to execute arbitrary JavaScript in the context of a user's session, leading to data theft or manipulation.

Which versions of MediaWiki are affected by CVE-2019-19708?

CVE-2019-19708 affects all versions of the VisualEditor extension for MediaWiki up to and including 1.34.

Is there a workaround for CVE-2019-19708?