VulnerabilityModified

CVE-2012-4379

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.

MEDIUM 6.5EPSS 1.45%

Does this matter?

Lower severity and a low EPSS score (1.45%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 1.45% probability · 73th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-284
Affected: mediawiki/mediawiki
Source: secalert@redhat.com

EPSS trend

EPSS 1.4% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853426Issue Tracking, Patch
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
https://phabricator.wikimedia.org/T41180Issue Tracking, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853426Issue Tracking, Patch
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
https://phabricator.wikimedia.org/T41180Issue Tracking, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.