CVE-2016-6334 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting7 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 55.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedApr 20
Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.27.1-1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.27.1-1+3
▶NVDmediawiki/mediawiki1.23.14+6

Patches

Patch: lists.wikimedia.org ↗Patch: phabricator.wikimedia.org ↗Patch: lists.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-9276-9qp2-vqp8: Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1↗2022-05-17
▶
OSV
CVE-2016-6334: Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1↗2017-04-20
▶

📋Vendor Advisories

1
Debian
CVE-2016-6334: mediawiki - Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 me...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15 [epel-all]↗2016-08-24
▶
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15↗2016-08-24
▶
Bugzilla
CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 mediawiki: multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15 [fedora-all]↗2016-08-24
▶
CVE-2016-6334 — Cross-site Scripting in Mediawiki | cvebase