Detections
Analytics
MediaWiki profileinfo.php 'filter' Parameter XSS
low Nessus Plugin ID 47902
Language:
Synopsis
A web application running on the remote host is affected by a cross-site scripting vulnerability.Description
The version of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to the 'filter' parameter in the 'profileinfo.php' script. A remote attacker can exploit this, by tricking a user into requesting a maliciously crafted URL, to execute arbitrary script code in the security context of the affected application.Installations that have the 'wgEnableProfileInfo' setting disabled are not affected. This setting is disabled by default.
Solution
Upgrade to MediaWiki 1.15.5 / 1.16.0 or later.See Also
Plugin Details
Severity: Low
ID: 47902
File Name: mediawiki_profileinfo_xss.nasl
Version: 1.16
Type: remote
Family: CGI abuses : XSS
Published: 7/29/2010
Updated: 6/5/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 2.3
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:mediawiki:mediawiki
Required KB Items: www/PHP, installed_sw/MediaWiki
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Patch Publication Date: 7/28/2010
Vulnerability Publication Date: 7/28/2010
Reference Information
CVE: CVE-2010-2788
BID: 42024