ID de Prueba:	1.3.6.1.4.1.25623.1.0.802910
Categoría:	Web application abuses
Título:	MediaWiki < 1.17.5, 1.18.x < 1.18.4, 1.19.x < 1.19.1 'uselang' Parameter XSS Vulnerability - Active Check
Resumen:	MediaWiki is prone to a cross-site scripting (XSS); vulnerability.
Descripción:	Summary: MediaWiki is prone to a cross-site scripting (XSS) vulnerability. Vulnerability Insight: Input passed via the 'uselang' parameter to 'index.php/Main_page' is not properly sanitised in the 'outputPage()' function, before being returned to the user. Vulnerability Impact: Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Affected Software/OS: MediaWiki versions prior to 1.17.5, 1.8.x prior to 1.18.4 and 1.19.x prior to 1.19.1. Solution: Update to version 1.17.5, 1.18.4, 1.19.1 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2012-2698 1027179 http://securitytracker.com/id?1027179 49484 http://secunia.com/advisories/49484 82983 http://www.osvdb.org/82983 [MediaWiki-announce] 20120613 MediaWiki security release 1.17.5 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000116.html [MediaWiki-announce] 20120613 MediaWiki security release 1.18.4 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000117.html [MediaWiki-announce] 20120613 MediaWiki security release 1.19.1 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000118.html [oss-security] 20120613 Re: CVE request: XSS in uselang http parameter (mediawiki) http://www.openwall.com/lists/oss-security/2012/06/14/2 https://bugzilla.wikimedia.org/show_bug.cgi?id=36938 https://gerrit.wikimedia.org/r/#/c/7979/1/includes/SkinTemplate.php https://www.mediawiki.org/wiki/Release_notes/1.17 https://www.mediawiki.org/wiki/Release_notes/1.18 https://www.mediawiki.org/wiki/Release_notes/1.19 mediawiki-index-uselang-xss(76311) https://exchange.xforce.ibmcloud.com/vulnerabilities/76311
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.