CVE-2011-0003
published 2011-01-11CVE-2011-0003: MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
PriorityP423medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
2.36%
82.0th percentile
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Affected
116 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mediawiki | < mediawiki 1:1.15.5-2 (bookworm) | mediawiki 1:1.15.5-2 (bookworm) |
| mediawiki | mediawiki | <= 1.16.0 | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
vendor_debian5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w85r-wgrm-jwhr: MediaWiki before 1
ghsa_unreviewed·2022-05-03
CVE-2011-0003 [MEDIUM] CWE-20 GHSA-w85r-wgrm-jwhr: MediaWiki before 1
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
OSV
CVE-2011-0003: MediaWiki before 1
osv·2011-01-11·CVSS 5.8
CVE-2011-0003 [MEDIUM] CVE-2011-0003: MediaWiki before 1
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Debian
CVE-2011-0003: mediawiki - MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows ...
vendor_debian·2011·CVSS 5.8
CVE-2011-0003 [MEDIUM] CVE-2011-0003: mediawiki - MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows ...
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Scope: local
bookworm: resolved (fixed in 1:1.15.5-2)
bullseye: resolved (fixed in 1:1.15.5-2)
forky: resolved (fixed in 1:1.15.5-2)
sid: resolved (fixed in 1:1.15.5-2)
trixie: resolved (fixed in 1:1.15.5-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-0003 mediawiki: clickjacking vulnerability
bugzilla·2011-01-04·CVSS 5.8
CVE-2011-0003 [MEDIUM] CVE-2011-0003 mediawiki: clickjacking vulnerability
CVE-2011-0003 mediawiki: clickjacking vulnerability
A clickjacking vulnerability was reported in MediaWiki [1]. This could allow a malicious web site to compromise the account of the user visiting a MediaWiki-based web site (an attack similar to cross-site scripting). For full protection, a user needs to be using a browser that supports the X-Frame-Options feature [2].
MediaWiki 1.16.1 [3] has been released to correct this flaw. For MediaWiki 1.15.x and earlier, a patch [4] is available which denies all framing.
[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=26561
[2] https://developer.mozilla.org/en/the_x-frame-options_response_header
[3] http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_1/phase3/RELEASE-NOTES
[4] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/79566
Th
Bugzilla
CVE-2011-0003 mediawiki: clickjacking vulnerability [epel-5]
bugzilla·2011-01-04·CVSS 5.8
CVE-2011-0003 [MEDIUM] CVE-2011-0003 mediawiki: clickjacking vulnerability [epel-5]
CVE-2011-0003 mediawiki: clickjacking vulnerability [epel-5]
epel-5 tracking bug for mediawiki: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
mediawiki has been blocked from EPEL 5.
Bugzilla
CVE-2011-0003 mediawiki: clickjacking vulnerability [fedora-all]
bugzilla·2011-01-04·CVSS 5.8
CVE-2011-0003 [MEDIUM] CVE-2011-0003 mediawiki: clickjacking vulnerability [fedora-all]
CVE-2011-0003 mediawiki: clickjacking vulnerability [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=667199
Please note: this issue affects multiple supported
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.htmlhttp://lists.wikimedia.org/pipermail/mediawiki-announce/2011-January/000093.htmlhttp://secunia.com/advisories/42810http://www.openwall.com/lists/oss-security/2011/01/04/12http://www.openwall.com/lists/oss-security/2011/01/04/6http://www.osvdb.org/70272http://www.vupen.com/english/advisories/2011/0017https://bugzilla.wikimedia.org/show_bug.cgi?id=26561https://exchange.xforce.ibmcloud.com/vulnerabilities/64476http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.htmlhttp://lists.wikimedia.org/pipermail/mediawiki-announce/2011-January/000093.htmlhttp://secunia.com/advisories/42810http://www.openwall.com/lists/oss-security/2011/01/04/12http://www.openwall.com/lists/oss-security/2011/01/04/6http://www.osvdb.org/70272http://www.vupen.com/english/advisories/2011/0017https://bugzilla.wikimedia.org/show_bug.cgi?id=26561https://exchange.xforce.ibmcloud.com/vulnerabilities/64476
2011-01-11
Published