Summary
This host is installed with TemplateSandbox
extension for MediaWiki and is prone to cross-site scripting vulnerability.
Impact
Successful exploitation will allow
remote attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
Impact Level: Application
Solution
Upgrade to TemplateSandbox extension version 1.24
or later. For updates refer to http://www.mediawiki.org/wiki/Special:ExtensionDistributor/TemplateSandbox
Insight
The flaw exist as input passed via
text parameter to the 'Extension:TemplateSandbox'. script is not validated before returning it to users.
Affected
TemplateSandbox extension version before 1.24 for Mediawiki
Detection
Send a crafted HTTP POST request
and check whether it is able to read cookie or not.
References
Severity
Classification
-
CVE CVE-2014-9479 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities
- Apache mod_proxy_ftp Wildcard Characters XSS Vulnerability
- Alt-N WebAdmin Remote Source Code Information Disclosure Vulnerability
- Apache ActiveMQ Multiple Vulnerabilities
- AjaXplorer Remote Command Injection and Local File Disclosure Vulnerabilities