Description

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.

Remediation

References

CVE-2012-4379

Related Vulnerabilities

Oracle JRE CVE-2013-2420 Vulnerability (CVE-2013-2420)

WordPress Plugin MukioPlayer SQL Injection (1.6)

OpenSSL Other Vulnerability (CVE-2014-3571)

MySQL CVE-2018-3282 Vulnerability (CVE-2018-3282)

WordPress Plugin Anti Plagiarism Cross-Site Scripting (3.60)

Severity

Medium

Classification

CVE-2012-4379 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities