CVE-2009-0737

Description

Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

http://www.vupen.com/english/advisories/2009/0368

http://www.securityfocus.com/bid/33681

http://www.debian.org/security/2009/dsa-1901

http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTES

http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTES

http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTES

http://secunia.com/advisories/33881

http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3