VulnerabilityModified

CVE-2009-0737

Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php) in MediaWiki 1.6 before 1.6.12, 1.12 before 1.12.4, and 1.13 before 1.13.4, when the installer is in active use, allow remote attackers to inject arbitrary…

LOW 2.6EPSS 1.48%

Does this matter?

Lower severity and a low EPSS score (1.48%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
EPSS: 1.48% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: mediawiki/mediawiki
Source: cve@mitre.org

References

http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.htmlPatch
http://secunia.com/advisories/33881Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTESVendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTESVendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTESVendor Advisory
http://www.debian.org/security/2009/dsa-1901
http://www.securityfocus.com/bid/33681Patch
http://www.vupen.com/english/advisories/2009/0368Patch, Vendor Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.htmlPatch
http://secunia.com/advisories/33881Vendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_4/phase3/RELEASE-NOTESVendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_4/phase3/RELEASE-NOTESVendor Advisory
http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_12/phase3/RELEASE-NOTESVendor Advisory
http://www.debian.org/security/2009/dsa-1901
http://www.securityfocus.com/bid/33681Patch
http://www.vupen.com/english/advisories/2009/0368Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.