Description

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."

Remediation

References

CVE-2017-8814

Related Vulnerabilities

Apache HTTP Server Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2007-3303)

Joomla CVE-2012-5827 Vulnerability (CVE-2012-5827)

WordPress Plugin Csv2WPeC Coupon Arbitrary File Upload (1.1)

WordPress Plugin Easy Forms for MailChimp Unspecified Vulnerability (6.3.2)

WordPress Plugin Secure Copy Content Protection and Content Locking SQL Injection (2.6.6)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2017-8814