DATABASE RESOURCES PRICING ABOUT US

{"id": "DEBIANCVE:CVE-2005-2396", "vendorId": null, "type": "debiancve", "bulletinFamily": "info", "title": "CVE-2005-2396", "description": "Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template.", "published": "2005-07-27T04:00:00", "modified": "2005-07-27T04:00:00", "epss": [{"cve": "CVE-2005-2396", "epss": 0.00414, "percentile": 0.70948, "modified": "2023-09-30"}], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE", "baseScore": 4.3}, "severity": "MEDIUM", "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {}, "href": "https://security-tracker.debian.org/tracker/CVE-2005-2396", "reporter": "Debian Security Bug Tracker", "references": [], "cvelist": ["CVE-2005-2396"], "immutableFields": [], "lastseen": "2023-10-01T20:00:06", "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-2396"]}, {"type": "gentoo", "idList": ["GLSA-200507-18"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200507-18.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:54994"]}]}, "score": {"value": 5.5, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2005-2396"]}, {"type": "gentoo", "idList": ["GLSA-200507-18"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200507-18.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:54994"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2005-2396", "epss": 0.00414, "percentile": 0.70152, "modified": "2023-05-03"}], "vulnersScore": 5.5}, "_state": {"dependencies": 1696217888, "score": 1696217771, "epss": 0}, "_internal": {"score_hash": "0f69928f90ec9ca800209ad5a535b554"}, "affectedPackage": [{"OS": "Debian", "OSVersion": "12", "arch": "all", "packageFilename": "mediawiki_1.4.9_all.deb", "packageVersion": "1.4.9", "operator": "lt", "status": "resolved", "packageName": "mediawiki"}, {"OS": "Debian", "OSVersion": "11", "arch": "all", "packageFilename": "mediawiki_1.4.9_all.deb", "packageVersion": "1.4.9", "operator": "lt", "status": "resolved", "packageName": "mediawiki"}, {"OS": "Debian", "OSVersion": "10", "arch": "all", "packageFilename": "mediawiki_1.4.9_all.deb", "packageVersion": "1.4.9", "operator": "lt", "status": "resolved", "packageName": "mediawiki"}, {"OS": "Debian", "OSVersion": "999", "arch": "all", "packageFilename": "mediawiki_1.4.9_all.deb", "packageVersion": "1.4.9", "operator": "lt", "status": "resolved", "packageName": "mediawiki"}]}

{"cve": [{"lastseen": "2023-10-01T05:31:06", "description": "Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template.", "cvss3": {}, "published": "2005-07-27T04:00:00", "type": "cve", "title": "CVE-2005-2396", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2005-2396"], "modified": "2017-07-11T01:32:00", "cpe": ["cpe:/a:mediawiki:mediawiki:1.3.0", "cpe:/a:mediawiki:mediawiki:1.2.0", "cpe:/a:mediawiki:mediawiki:1.2.1", "cpe:/a:mediawiki:mediawiki:1.4_beta6", "cpe:/a:mediawiki:mediawiki:1.4.2", "cpe:/a:mediawiki:mediawiki:1.3", "cpe:/a:mediawiki:mediawiki:1.2.2", "cpe:/a:mediawiki:mediawiki:1.3.1", "cpe:/a:mediawiki:mediawiki:1.2.6", "cpe:/a:mediawiki:mediawiki:1.3.2", "cpe:/a:mediawiki:mediawiki:1.3.10", "cpe:/a:mediawiki:mediawiki:1.4_beta1", "cpe:/a:mediawiki:mediawiki:1.3.6", "cpe:/a:mediawiki:mediawiki:1.2.5", "cpe:/a:mediawiki:mediawiki:1.4.5", "cpe:/a:mediawiki:mediawiki:1.3.7", "cpe:/a:mediawiki:mediawiki:1.4_beta3", "cpe:/a:mediawiki:mediawiki:1.3.3", "cpe:/a:mediawiki:mediawiki:1.4_beta5", "cpe:/a:mediawiki:mediawiki:1.1.0", "cpe:/a:mediawiki:mediawiki:1.4_beta2", "cpe:/a:mediawiki:mediawiki:1.2.4", "cpe:/a:mediawiki:mediawiki:1.3.5", "cpe:/a:mediawiki:mediawiki:1.3.11", "cpe:/a:mediawiki:mediawiki:1.4.1", "cpe:/a:mediawiki:mediawiki:1.2.3", "cpe:/a:mediawiki:mediawiki:1.3.8", "cpe:/a:mediawiki:mediawiki:1.3.9", "cpe:/a:mediawiki:mediawiki:1.4_beta4", "cpe:/a:mediawiki:mediawiki:1.4.3", "cpe:/a:mediawiki:mediawiki:1.3.4"], "id": "CVE-2005-2396", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2396", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:mediawiki:mediawiki:1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta3:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta5:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta1:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.11:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.10:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.9:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta2:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta4:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:mediawiki:mediawiki:1.4_beta6:*:*:*:*:*:*:*"]}], "nessus": [{"lastseen": "2023-05-18T14:18:12", "description": "The remote host is affected by the vulnerability described in GLSA-200507-18 (MediaWiki: XSS vulnerability)\n\n MediaWiki fails to escape a parameter in the page move template correctly.\n Impact :\n\n By enticing a user to visit a specially crafted URL, a remote attacker could exploit this vulnerability to inject malicious JavaScript code that will be executed in a user's browser session in the context of the vulnerable site.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2005-07-20T00:00:00", "type": "nessus", "title": "GLSA-200507-18 : MediaWiki: XSS vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2005-2396"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:mediawiki", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-200507-18.NASL", "href": "https://www.tenable.com/plugins/nessus/19231", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200507-18.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(19231);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-2396\");\n script_xref(name:\"GLSA\", value:\"200507-18\");\n\n script_name(english:\"GLSA-200507-18 : MediaWiki: XSS vulnerability\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200507-18\n(MediaWiki: XSS vulnerability)\n\n MediaWiki fails to escape a parameter in the page move template\n correctly.\n \nImpact :\n\n By enticing a user to visit a specially crafted URL, a remote attacker\n could exploit this vulnerability to inject malicious JavaScript code\n that will be executed in a user's browser session in the context of the\n vulnerable site.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n # http://sourceforge.net/project/shownotes.php?release_id=342530\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?402bae80\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200507-18\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All MediaWiki users should upgrade to the latest available version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-apps/mediawiki-1.4.7'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:mediawiki\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/07/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/07/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"www-apps/mediawiki\", unaffected:make_list(\"ge 1.4.6\"), vulnerable:make_list(\"lt 1.4.6\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"MediaWiki\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "gentoo": [{"lastseen": "2023-09-27T02:33:16", "description": "### Background\n\nMediaWiki is a collaborative editing software, used by big projects like Wikipedia. \n\n### Description\n\nMediaWiki fails to escape a parameter in the page move template correctly. \n\n### Impact\n\nBy enticing a user to visit a specially crafted URL, a remote attacker could exploit this vulnerability to inject malicious JavaScript code that will be executed in a user's browser session in the context of the vulnerable site. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll MediaWiki users should upgrade to the latest available version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-apps/mediawiki-1.4.7\"", "cvss3": {}, "published": "2005-07-20T00:00:00", "type": "gentoo", "title": "MediaWiki: Cross-site scripting vulnerability", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2005-2396"], "modified": "2005-08-11T00:00:00", "id": "GLSA-200507-18", "href": "https://security.gentoo.org/glsa/200507-18", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2017-07-24T12:49:46", "description": "The remote host is missing updates announced in\nadvisory GLSA 200507-18.", "cvss3": {}, "published": "2008-09-24T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200507-18 (mediawiki)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2005-2396"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:54994", "href": "http://plugins.openvas.org/nasl.php?oid=54994", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"MediaWiki is vulnerable to a cross-site scripting attack that could allow\narbitrary JavaScript code execution.\";\ntag_solution = \"All MediaWiki users should upgrade to the latest available version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=www-apps/mediawiki-1.4.7'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200507-18\nhttp://bugs.gentoo.org/show_bug.cgi?id=99132\nhttp://sourceforge.net/project/shownotes.php?release_id=342530\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200507-18.\";\n\n \n\nif(description)\n{\n script_id(54994);\n script_cve_id(\"CVE-2005-2396\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_name(\"Gentoo Security Advisory GLSA 200507-18 (mediawiki)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"www-apps/mediawiki\", unaffected: make_list(\"ge 1.4.6\"), vulnerable: make_list(\"lt 1.4.6\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}