Vulnerability Name:

CVE-2006-2611 (CCN-26646)

Assigned:2006-05-23
Published:2006-05-23
Updated:2017-07-20
Summary:Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Wikimedia Bugzilla Bug 6055
Javascript Security Exploit

Source: MISC
Type: Exploit, Patch
http://bugzilla.wikimedia.org/show_bug.cgi?id=6055

Source: MITRE
Type: CNA
CVE-2006-2611

Source: MLIST
Type: Exploit
[Wikitech-l] 20060523 MediaWiki 1.6.5 JavaScript Execution Vulnerability # 2

Source: MLIST
Type: Patch
[Wikitech-l] 20060523 MediaWiki 1.6.5 JavaScript Execution Vulnerability # 2

Source: MISC
Type: UNKNOWN
http://nickj.org/MediaWiki

Source: CCN
Type: SA20189
MediaWiki Script Insertion Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
20189

Source: MISC
Type: Patch
http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349

Source: CONFIRM
Type: Patch
http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349

Source: CCN
Type: MediaWiki Download Web page
Download - Mediawiki

Source: OSVDB
Type: UNKNOWN
25713

Source: CCN
Type: OSVDB ID: 25713
MediaWiki Parser Unspecified XSS

Source: VUPEN
Type: UNKNOWN
ADV-2006-1926

Source: XF
Type: UNKNOWN
mediawiki-unspecified-handler-xss(26646)

Source: XF
Type: UNKNOWN
mediawiki-unspecified-handler-xss(26646)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mediawiki:mediawiki:1.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:*:*:*:*:*:*:*:* (Version <= 1.6.5_r14348)

    • * Denotes that component is vulnerable
    BACK
    mediawiki mediawiki 1.6.5
    mediawiki mediawiki *