This host is installed with TemplateSandbox extension for MediaWiki and is prone to cross-site scripting vulnerability.

Successful exploitation will allow remote attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Impact Level: Application

Upgrade to TemplateSandbox extension version 1.24 or later. For updates refer to http://www.mediawiki.org/wiki/Special:ExtensionDistributor/TemplateSandbox

The flaw exist as input passed via text parameter to the 'Extension:TemplateSandbox'. script is not validated before returning it to users.

TemplateSandbox extension version before 1.24 for Mediawiki

Send a crafted HTTP POST request and check whether it is able to read cookie or not.

• http://www.openwall.com/lists/oss-security/2015/01/03/13
• https://phabricator.wikimedia.org/T77625

---

Updated on 2015-03-25