MediaWiki Cross-site Scripting (XSS) in mediawiki/core
Summary
CVE-2019-12471: MediaWiki Cross-site Scripting (XSS). Affects mediawiki/core across 3 version ranges.
>= 1.27.0, < 1.27.6
>= 1.30.0, < 1.30.2
>= 1.31.0, < 1.31.2
Fixed in 1.27.6, 1.30.2 or 1.31.2, depending on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:11
The same CVE-2019-12471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a free and open-source wiki software package written in PHP. It is widely used to power various websites, including Wikipedia. The mediawiki/core package is the core component of MediaWiki, responsible for providing the fundamental functionality and features of the software. Unfortunately, versions 1.30.0 through 1.32.1 of MediaWiki's core package are vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The XSS vulnerability in MediaWiki allows an attacker to inject malicious JavaScript code into the web application, which is then executed by unsuspecting users who visit the affected pages. This vulnerability is caused by the ability to load user JavaScript from a non-existent account, which can be exploited by anyone to create the account and perform XSS attacks on users who load that script. The impact of this vulnerability can range from unauthorized data access to complete control over the affected user's session. The vulnerability has been assigned a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.27.0, < 1.27.61.27.6composer require mediawiki/core:1.27.6 -
>= 1.30.0, < 1.30.21.30.2composer require mediawiki/core:1.30.2 -
>= 1.31.0, < 1.31.21.31.2composer require mediawiki/core:1.31.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by disabling the loading of user JavaScript in MediaWiki. This can be achieved by modifying the configuration settings or applying a patch provided by the MediaWiki community. It is important to note that this workaround may impact certain functionality that relies on user JavaScript, so it should only be considered as a temporary measure until the software can be upgraded.
Conclusion
In conclusion, the mediawiki/core package of MediaWiki versions 1.30.0 through 1.32.1 is vulnerable to a Cross-site Scripting (XSS) attack. It is crucial to upgrade to a patched version (1.32.2, 1.31.2, 1.30.2, or 1.27.6) to mitigate this vulnerability. If immediate upgrading is not possible, disabling the loading of user JavaScript can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki is a free and open-source wiki software package written in PHP. It is widely used to power various websites, including Wikipedia.
The mediawiki/core package is the core component of MediaWiki, responsible for providing the fundamental functionality and features of the software.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The impact of this vulnerability can range from unauthorized data access to complete control over the affected user's session.
To fix this vulnerability, it is recommended to upgrade to a patched version of MediaWiki (1.32.2, 1.31.2, 1.30.2, or 1.27.6).
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
