CVE-2015-2932

Description

Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element.

References

http://www.mandriva.com/security/advisories?name=MDVSA-2015:200

http://www.openwall.com/lists/oss-security/2015/04/01/1

http://www.openwall.com/lists/oss-security/2015/04/07/3

http://www.securityfocus.com/bid/73477

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

https://phabricator.wikimedia.org/T86711

https://security.gentoo.org/glsa/201510-05

Details

Risk Information

CVSS v2