CVE-2015-2931

2015-04-1314:59:04

Debian Security Bug Tracker

security-tracker.debian.org

0.005 Low

EPSS

Percentile

76.0%

JSON

Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.

OSVersionArchitecturePackageVersionFilename
Debian12allmediawiki< 1:1.19.20+dfsg-2.3mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian11allmediawiki< 1:1.19.20+dfsg-2.3mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian10allmediawiki< 1:1.19.20+dfsg-2.3mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian999allmediawiki< 1:1.19.20+dfsg-2.3mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian13allmediawiki< 1:1.19.20+dfsg-2.3mediawiki_1:1.19.20+dfsg-2.3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mediawiki	< 1:1.19.20+dfsg-2.3	mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian	11	all	mediawiki	< 1:1.19.20+dfsg-2.3	mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian	10	all	mediawiki	< 1:1.19.20+dfsg-2.3	mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian	999	all	mediawiki	< 1:1.19.20+dfsg-2.3	mediawiki_1:1.19.20+dfsg-2.3_all.deb
Debian	13	all	mediawiki	< 1:1.19.20+dfsg-2.3	mediawiki_1:1.19.20+dfsg-2.3_all.deb

0.005 Low

EPSS

Percentile

76.0%

JSON

Related for DEBIANCVE:CVE-2015-2931