GHSA-6h86-9r5g-f2h5

Source

https://github.com/advisories/GHSA-6h86-9r5g-f2h5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6h86-9r5g-f2h5/GHSA-6h86-9r5g-f2h5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6h86-9r5g-f2h5

Aliases

CVE-2014-2853

Published

2022-05-17T04:07:54Z

Modified

2024-12-02T05:45:20.512467Z

Summary

Cross-site scripting vulnerability in includes/actions/InfoAction.php

Details

Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-01T23:10:24Z",
    "nvd_published_at": "2014-04-29T18:55:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Packagist / mediawiki/core

Package

Name: mediawiki/core
Purl: pkg:composer/mediawiki/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.21.9

Affected versions

1.*

1.20.3

1.20.4

1.20.5

1.20.6

1.20.7

1.20.8

1.21.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.5

1.21.6

1.21.7

1.21.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6h86-9r5g-f2h5/GHSA-6h86-9r5g-f2h5.json"

Packagist / mediawiki/core

Package

Name: mediawiki/core
Purl: pkg:composer/mediawiki/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.22.0

Fixed

1.22.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6h86-9r5g-f2h5/GHSA-6h86-9r5g-f2h5.json"