Bug 287881 (CVE-2007-4828) - CVE-2007-4828 mediawiki cross-site scripting vulnerability
Summary: CVE-2007-4828 mediawiki cross-site scripting vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-4828
Product: Fedora
Classification: Fedora
Component: mediawiki
Version: 7
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
Assignee: Axel Thimm
QA Contact: Fedora Extras Quality Assurance
URL: http://secunia.com/advisories/26772/
Whiteboard: source=gentoo,reported=20070911,publi...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-09-12 16:01 UTC by Tomas Hoger
Modified: 2007-11-30 22:12 UTC (History)
3 users (show)

Fixed In Version: 1.9.4-35.fc7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-09-18 03:22:37 UTC


Attachments (Terms of Use)

Description Tomas Hoger 2007-09-12 16:01:13 UTC
Secunia published security advisory for mediawiki:

http://secunia.com/advisories/26772/


A vulnerability has been reported in MediaWiki, which can be exploited by
malicious people to conduct cross-site scripting attacks.

Input passed to unspecified parameters in the API pretty-printing mode is not
properly sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in context of
an affected site.

Successful exploitation requires that the API interface is enabled.

The vulnerability is reported in the following versions:
* 1.11 <= 1.11.0rc1
* 1.10 <= 1.10.1
* 1.9 <= 1.9.3
* 1.8 <= 1.8.4 (if $wgEnableAPI has been switched on)

Solution: Update to version 1.11.0, 1.10.2, 1.9.4, or 1.8.5.


Versions currently in Fedora falls into "affected" range, even though there is
following note in changelog for release 1.9.3-34:

- Update to 1.9.4.

It only seems to be typo.  If there's any other reason why Fedora packages are
not affected, feel free to close this bug with appropriate comment.

Comment 1 Ville Skyttä 2007-09-12 18:35:28 UTC
Builds done for all active Fedora releases, waiting for them to be pushed.

Comment 2 Fedora Update System 2007-09-18 03:22:36 UTC
mediawiki-1.9.4-35.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.