Description

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."

Remediation

References

CVE-2015-8622

Related Vulnerabilities

Oracle Application Server CVE-2009-0990 Vulnerability (CVE-2009-0990)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32472)

Nexus Repository Manager Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2021-43961)

phpMyFAQ Improper Privilege Management Vulnerability (CVE-2023-1762)

WordPress 'paged' Parameter SQL Injection Vulnerability (2.0.2 - 2.0.5)

Severity

Medium

Classification

CVE-2015-8622 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities