VulnerabilityModified
CVE-2007-1055
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter.
MEDIUM 6.8EPSS 2.07%
Does this matter?
Lower severity and a low EPSS score (2.07%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter. NOTE: this issue might be a duplicate of CVE-2007-0177.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.07% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- mediawiki/mediawiki
- Source
- cve@mitre.org
References
- http://osvdb.org/37343Broken Link
- http://securityreason.com/securityalert/2274Exploit, Third Party Advisory
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0/phase3/RELEASE-NOTESThird Party Advisory
- http://www.bugsec.com/articles.php?Security=24Broken Link, Third Party Advisory
- http://www.securityfocus.com/archive/1/460596/100/0/threadedThird Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32586Third Party Advisory, VDB Entry
- http://osvdb.org/37343Broken Link
- http://securityreason.com/securityalert/2274Exploit, Third Party Advisory
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_9_0/phase3/RELEASE-NOTESThird Party Advisory
- http://www.bugsec.com/articles.php?Security=24Broken Link, Third Party Advisory
- http://www.securityfocus.com/archive/1/460596/100/0/threadedThird Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32586Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.