Description

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.

Remediation

References

CVE-2012-4379

Related Vulnerabilities

WordPress Plugin Request a Quote Cross-Site Scripting (2.3.3)

PHP Other Vulnerability (CVE-2003-0172)

WordPress Other Vulnerability (CVE-2005-2108)

WordPress Plugin Contentboxes Cross-Site Scripting (1.1)

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.19)

Severity

Medium

Classification

CVE-2012-4379 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities