CVE-2012-2698
Published: 29 June 2012
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.
Notes
Author | Note |
---|---|
jdstrand | per Debian, introduced in r49331 (after 1.15) |
Priority
Status
Package | Release | Status |
---|---|---|
mediawiki Launchpad, Ubuntu, Debian |
upstream |
Released
(1:1.19.1-1)
|
hardy |
Not vulnerable
|
|
lucid |
Not vulnerable
|
|
natty |
Not vulnerable
|
|
oneiric |
Not vulnerable
|
|
precise |
Not vulnerable
|
|
quantal |
Not vulnerable
(1:1.15.5-10)
|
|
Patches: other: https://gerrit.wikimedia.org/r/#/c/7979/ |