Description
Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.
References (7)
Core 7
Core References
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201510-05
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2015:200
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/73477
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/07/3
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/01/1
Patch, Vendor Advisory mailing-list
x_refsource_mlist
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
Issue Tracking x_refsource_confirm
https://phabricator.wikimedia.org/T86711
Scores
EPSS
0.0028
EPSS Percentile
51.5%
Details
CWE
CWE-79
Status
published
Products (49)
mediawiki/mediawiki
1.20
mediawiki/mediawiki
1.20.1
mediawiki/mediawiki
1.20.2
mediawiki/mediawiki
1.20.3
mediawiki/mediawiki
1.20.4
mediawiki/mediawiki
1.20.5
mediawiki/mediawiki
1.20.6
mediawiki/mediawiki
1.20.7
mediawiki/mediawiki
1.20.8
mediawiki/mediawiki
1.21
... and 39 more
Published
Apr 13, 2015
Tracked Since
Feb 18, 2026