CVE-2014-3966

Related Files

Debian Security Advisory 2957-1

Posted Jun 13, 2014

Authored by Debian | Site debian.org

Debian Linux Security Advisory 2957-1 - Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack.

tags | advisory, javascript, xss

systems | linux, debian

advisories | CVE-2014-3966

SHA-256 | 19b4e0e8cff7a78116f8653d8bbc33fdb71622b5dead1492c49e96bcb9629e9f

Download | Favorite | View

Mandriva Linux Security Advisory 2014-119

Posted Jun 12, 2014

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-119 - XSS vulnerability in MediaWiki before 1.22.7, due to usernames on Special:PasswordReset being parsed as wikitext. The username on Special:PasswordReset can be supplied by anyone and will be parsed with wgRawHtml enabled. Since Special:PasswordReset is whitelisted by default on private wikis, this could potentially lead to an XSS crossing a privilege boundary.

tags | advisory

systems | linux, mandriva

advisories | CVE-2014-3966

SHA-256 | a1992ff84b104e35deccf903a719347089e5ad68eb7da559aca1b6174e9da33c

Download | Favorite | View