CVE-2006-2611

MediaWiki < 1.6.5_r14348 - Cross-Site Scripting via Variable Handler

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.

References (10)

Core 10

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/25713

Various Sources x_refsource_misc

http://nickj.org/MediaWiki

Exploit, Patch x_refsource_misc

http://bugzilla.wikimedia.org/show_bug.cgi?id=6055

Exploit mailing-list x_refsource_mlist

http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035812.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/26646

Patch x_refsource_confirm

http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/1926

Patch x_refsource_misc

http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349

Patch mailing-list x_refsource_mlist

http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035814.html

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20189

Scores

EPSS 0.0141

EPSS Percentile 80.8%

Details

Status published

Products (2)

mediawiki/mediawiki 1.6.5

mediawiki/mediawiki < 1.6.5_r14348

Published May 26, 2006

Tracked Since Feb 18, 2026