Summary
A flaw was discovered in mediawiki, a wiki
engine: cross-domain-policy mangling allows an article editor to inject code into API consumers that deserialize PHP representations of the page from the API.
Solution
For the stable distribution (wheezy), this
problem has been fixed in version 1.19.20+dfsg-0+deb7u2.
We recommend that you upgrade your mediawiki packages.
Insight
MediaWiki is a wiki engine (a
program for creating a collaboratively edited website). It is designed to handle heavy websites containing library-like document collections, and supports user uploads of images/sounds, multilingual content, TOC autogeneration, ISBN links, etc.
Affected
mediawiki on Debian Linux
Detection
This check tests the installed software
version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-9277 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities