Description
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.
Remediation
References
Related Vulnerabilities
TYPO3 Insertion of Sensitive Information into Log File Vulnerability (CVE-2022-31047)
Apache HTTP Server Other Vulnerability (CVE-2002-0843)
Coppermine Cross-site Scripting (XSS) Vulnerability (CVE-2018-14478)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4289)
Oracle Database Server CVE-2011-0785 Vulnerability (CVE-2011-0785)