Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

altlinux логотип

ALT-PU-2014-2433

Высокий

ALT-PU-2014-2433: package mediawiki update to version 1.23.7-alt1

Источник
errata.altlinux.org
Дата публикации
09.12.2014
Дата обновления
09.12.2014
Устраненные уязвимости
3
ALT Linux branch p11
ALT Container
ALT Education
ALT Workstation
ALT Workstation K
ALT Server
ALT Virtualization PVE Edition
ALT Linux branch p10
ALT Server
ALT Virtualization Server
ALT Workstation
ALT Workstation K
ALT Education
Simply Linux
Starterkit
ALT Container

Описание

This update upgrades mediawiki to version 1.23.7-alt1.

Устраненные уязвимости3

Ссылки1

ALT-PU-2014-2433https://errata.altlinux.org/ALT-PU-2014-2433

Связанные уязвимости

ubuntu логотип

CVE-2014-9276

ubuntu
почти 12 лет назад

Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.

nvd логотип

CVE-2014-9276

nvd
почти 12 лет назад

Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.

debian логотип

CVE-2014-9276

debian
почти 12 лет назад

Cross-site request forgery (CSRF) vulnerability in the Special:Expande ...

github логотип

GHSA-4rrq-7p7h-pfq3

github
больше 4 лет назад

Cross-site request forgery (CSRF) vulnerability in the Special:ExpandedTemplates page in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgRawHTML is set to true, allows remote attackers to hijack the authentication of users with edit permissions for requests that cross-site scripting (XSS) attacks via the wpInput parameter, which is not properly handled in the preview.

ubuntu логотип

CVE-2014-9507

ubuntu
почти 12 лет назад

MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.