CVE-2010-2788
published 2011-04-27CVE-2010-2788: Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject…
PriorityP410low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
1.56%
72.6th percentile
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Affected
111 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mediawiki | < mediawiki 1:1.15.5-1 (bookworm) | mediawiki 1:1.15.5-1 (bookworm) |
| mediawiki | mediawiki | <= 1.15.4 | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv2.6LOW
vendor_debian2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2010-2788: mediawiki - Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before ...
vendor_debian·2010·CVSS 2.6
CVE-2010-2788 [LOW] CVE-2010-2788: mediawiki - Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before ...
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Scope: local
bookworm: resolved (fixed in 1:1.15.5-1)
bullseye: resolved (fixed in 1:1.15.5-1)
forky: resolved (fixed in 1:1.15.5-1)
sid: resolved (fixed in 1:1.15.5-1)
trixie: resolved (fixed in 1:1.15.5-1)
GHSA
GHSA-cq27-jh5r-c8pc: Cross-site scripting (XSS) vulnerability in profileinfo
ghsa_unreviewed·2022-05-17
CVE-2010-2788 [LOW] CWE-79 GHSA-cq27-jh5r-c8pc: Cross-site scripting (XSS) vulnerability in profileinfo
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
OSV
CVE-2010-2788: Cross-site scripting (XSS) vulnerability in profileinfo
osv·2011-04-27·CVSS 2.6
CVE-2010-2788 [LOW] CVE-2010-2788: Cross-site scripting (XSS) vulnerability in profileinfo
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-2787 CVE-2010-2788 mediawiki various flaws [fedora-all]
bugzilla·2010-08-01·CVSS 4.3
CVE-2010-2787 [MEDIUM] CVE-2010-2787 CVE-2010-2788 mediawiki various flaws [fedora-all]
CVE-2010-2787 CVE-2010-2788 mediawiki various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=620224
Please note: this issue affects multiple supported
Bugzilla
CVE-2010-2788 MediaWiki (< v1.15.5, v1.16.0): XSS in profileinfo.php
bugzilla·2010-08-01·CVSS 2.6
CVE-2010-2788 [LOW] CVE-2010-2788 MediaWiki (< v1.15.5, v1.16.0): XSS in profileinfo.php
CVE-2010-2788 MediaWiki (< v1.15.5, v1.16.0): XSS in profileinfo.php
MediaWiki upstream has released:
[1] http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
v1.16.0 and v.1.15.5 versions of MediaWiki, addressing the following XSS flaw (from [1]):
A cross-site scripting (XSS) vulnerability was discovered in
profileinfo.php. The vulnerability is only exposed when the script is
explicitly enabled in LocalSettings.php, with $wgEnableProfileInfo = true.
Discussion:
This issue affects the versions of the mediawiki package, as shipped
with Fedora release of 12 and 13.
Please fix.
---
Created mediawiki tracking bugs for this issue
Affects: fedora-all [bug 620226]
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.htmlhttp://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlhttp://openwall.com/lists/oss-security/2010/07/29/4http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984http://www.securityfocus.com/bid/42024https://bugzilla.redhat.com/show_bug.cgi?id=620225https://bugzilla.redhat.com/show_bug.cgi?id=620226http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.htmlhttp://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlhttp://openwall.com/lists/oss-security/2010/07/29/4http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984http://www.securityfocus.com/bid/42024https://bugzilla.redhat.com/show_bug.cgi?id=620225https://bugzilla.redhat.com/show_bug.cgi?id=620226
2011-04-27
Published