CVE-2009-4589
published 2010-01-07CVE-2009-4589: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and…
PriorityP416medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.36%
68.8th percentile
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mediawiki | < mediawiki 1:1.15.0-1.1 (bookworm) | mediawiki 1:1.15.0-1.1 (bookworm) |
| mediawiki | mediawik | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | >= 0 < 1:1.15.0-1.1 | 1:1.15.0-1.1 |
| mediawiki | mediawiki | >= 0 < 1:1.15.0-1.1 | 1:1.15.0-1.1 |
| mediawiki | mediawiki | >= 0 < 1:1.15.0-1.1 | 1:1.15.0-1.1 |
| mediawiki | mediawiki | >= 0 < 1:1.15.0-1.1 | 1:1.15.0-1.1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7wv2-pcxg-363g: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip
ghsa_unreviewed·2022-05-02
CVE-2009-4589 [MEDIUM] CWE-79 GHSA-7wv2-pcxg-363g: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
OSV
CVE-2009-4589: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip
osv·2010-01-07·CVSS 4.3
CVE-2009-4589 [MEDIUM] CVE-2009-4589: Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
Debian
CVE-2009-4589: mediawiki - Cross-site scripting (XSS) vulnerability in the Special:Block implementation in ...
vendor_debian·2009·CVSS 4.3
CVE-2009-4589 [MEDIUM] CVE-2009-4589: mediawiki - Cross-site scripting (XSS) vulnerability in the Special:Block implementation in ...
Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter.
Scope: local
bookworm: resolved (fixed in 1:1.15.0-1.1)
bullseye: resolved (fixed in 1:1.15.0-1.1)
forky: resolved (fixed in 1:1.15.0-1.1)
sid: resolved (fixed in 1:1.15.0-1.1)
trixie: resolved (fixed in 1:1.15.0-1.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.htmlhttp://osvdb.org/55824http://secunia.com/advisories/35818http://www.securityfocus.com/bid/35662http://www.vupen.com/english/advisories/2009/1882https://bugzilla.wikimedia.org/show_bug.cgi?id=19693https://exchange.xforce.ibmcloud.com/vulnerabilities/51687http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-July/000087.htmlhttp://osvdb.org/55824http://secunia.com/advisories/35818http://www.securityfocus.com/bid/35662http://www.vupen.com/english/advisories/2009/1882https://bugzilla.wikimedia.org/show_bug.cgi?id=19693https://exchange.xforce.ibmcloud.com/vulnerabilities/51687
2010-01-07
Published