Vulnerability Name:

CVE-2008-0460 (CCN-39901)

Assigned:2008-01-24
Published:2008-01-24
Updated:2021-07-23
Summary:Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-0460

Source: CCN
Type: MediaWiki-announce Mailing List, Thu Jan 24 00:59:14 UTC 2008
MediaWiki 1.11.1, 1.10.3, 1.9.5 released

Source: MLIST
Type: UNKNOWN
[MediaWiki-announce] 20080124 MediaWiki 1.11.1, 1.10.3, 1.9.5 released

Source: CCN
Type: SA28629
MediaWiki Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: Vendor Advisory
28629

Source: SECUNIA
Type: UNKNOWN
29266

Source: CCN
Type: MediaWiki Web site
MediaWiki - MediaWiki

Source: CCN
Type: OSVDB ID: 40510
MediaWiki api.php Unspecified XSS

Source: BID
Type: UNKNOWN
28137

Source: CCN
Type: BID-28137
MediaWiki 'api.php' Cross-Site Scripting Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2008-0280

Source: XF
Type: UNKNOWN
mediawiki-api-xss(39901)

Source: XF
Type: UNKNOWN
mediawiki-api-xss(39901)

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-2245

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-2288

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mediawiki:mediawiki:1.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.10.2:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.8.3:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.11:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.11.0rc1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.9.0:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.10.0:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:*:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki_botquery_ext:*:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.7.0:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:mediawiki:mediawiki:1.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki_botquery_ext:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    mediawiki mediawiki 1.10.1
    mediawiki mediawiki 1.10.2
    mediawiki mediawiki 1.8.3
    mediawiki mediawiki 1.8.4
    mediawiki mediawiki 1.11
    mediawiki mediawiki 1.11.0rc1
    mediawiki mediawiki 1.9.0
    mediawiki mediawiki 1.9.1
    mediawiki mediawiki 1.10.0
    mediawiki mediawiki 1.8.1
    mediawiki mediawiki 1.8.2
    mediawiki mediawiki 1.9.3
    microsoft internet explorer *
    mediawiki mediawiki 1.8.0
    mediawiki mediawiki 1.9.2
    mediawiki mediawiki 1.9.4
    mediawiki mediawiki botquery ext *
    mediawiki mediawiki 1.7.0
    mediawiki mediawiki 1.7.0
    mediawiki mediawiki botquery ext *
    microsoft internet explorer *