CVE-2010-2788 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
2.6LOWNVD
EPSS
0.7%
top 28.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedApr 27
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

CVSS vector

AV:N/AC:H/C:N/I:P/A:NExploitability: 4.9 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.15.5-1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.15.5-1+3
▶NVDmediawiki/mediawiki1.15.4+105

Patches

Patch: lists.fedoraproject.org ↗Patch: lists.wikimedia.org ↗Patch: openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cq27-jh5r-c8pc: Cross-site scripting (XSS) vulnerability in profileinfo↗2022-05-17
▶
OSV
CVE-2010-2788: Cross-site scripting (XSS) vulnerability in profileinfo↗2011-04-27
▶

📋Vendor Advisories

1
Debian
CVE-2010-2788: mediawiki - Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before ...↗2010
▶

💬Community

2
Bugzilla
CVE-2010-2787 CVE-2010-2788 mediawiki various flaws [fedora-all]↗2010-08-01
▶
Bugzilla
CVE-2010-2788 MediaWiki (< v1.15.5, v1.16.0): XSS in profileinfo.php↗2010-08-01
▶
CVE-2010-2788 — Cross-site Scripting in Mediawiki | cvebase