Bug 2436175 (CVE-2025-67477)
| Summary: | CVE-2025-67477 MediaWiki: MediaWiki: Cross-site Scripting vulnerability | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in MediaWiki. An Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS), vulnerability exists in the `ApiSandboxLayout.Js` program file. This flaw could potentially allow an attacker with high privileges to inject malicious scripts into web pages. While the direct impact is not specified, XSS vulnerabilities typically enable client-side attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2436195, 2436197 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-02-03 02:01:16 UTC
|