Updated mediawiki packages fix security vulnerability

2014-06-0610:08:57

Gentoo Foundation

advisories.mageia.org

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

69.3%

JSON

XSS vulnerability in MediaWiki before 1.22.7, due to usernames on Special:PasswordReset being parsed as wikitext. The username on Special:PasswordReset can be supplied by anyone and will be parsed with wgRawHtml enabled. Since Special:PasswordReset is whitelisted by default on private wikis, this could potentially lead to an XSS crossing a privilege boundary (CVE-2014-3966).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchmediawiki< 1.22.7-1mediawiki-1.22.7-1.mga3
Mageia4noarchmediawiki< 1.22.7-1mediawiki-1.22.7-1.mga4