CVE-2016-6333 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting7 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 43.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedApr 20
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.27.1-1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.27.1-1+3
▶NVDmediawiki/mediawiki1.23.14+6

Patches

Patch: lists.wikimedia.org ↗Patch: phabricator.wikimedia.org ↗Patch: lists.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-hxwm-9f7g-wg4h: Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1↗2022-05-17
▶
OSV
CVE-2016-6333: Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1↗2017-04-20
▶

📋Vendor Advisories

1
Debian
CVE-2016-6333: mediawiki - Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15 [epel-all]↗2016-08-24
▶
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15↗2016-08-24
▶
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15 [fedora-all]↗2016-08-24
▶