CVE-2012-4378

NameCVE-2012-4378
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs686330

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mediawiki (PTS)stretch1:1.27.7-1~deb9u3fixed
stretch (security)1:1.27.7-1~deb9u5fixed
buster1:1.31.7-1~deb10u1fixed
buster (security)1:1.31.10-1~deb10u1fixed
bullseye, sid1:1.35.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mediawikisourcesqueeze(unfixed)end-of-life
mediawikisource(unstable)1:1.19.2-1686330

Notes

https://bugzilla.wikimedia.org/show_bug.cgi?id=37587
https://www.openwall.com/lists/oss-security/2012/08/31/6

Search for package or bug name: Reporting problems