Vulnerability CVE-2015-6729

Vulnerability Name:

CVE-2015-6729 (CCN-106200)

Assigned:

2015-08-12

Published:

2015-08-12

Updated:

2016-12-07

Summary:

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.

CVSS v3 Severity:

6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2015-6729

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-13920

Source: CCN
Type: oss-sec Mailing List, Wed, 12 Aug 2015 06:07:55 -0700
CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10

Source: MLIST
Type: UNKNOWN
[oss-security] 20150812 CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10

Source: MLIST
Type: UNKNOWN
[oss-security] 20150827 Re: CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10

Source: BID
Type: UNKNOWN
76334

Source: CCN
Type: BID-76334
MediaWiki Multiple Security Vulnerabilities

Source: XF
Type: UNKNOWN
mediawiki-cve20156729-xss(106200)

Source: CCN
Type: MediaWiki-announce, Mon Aug 10 21:54:44 UTC 2015
[MediaWiki-announce] MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10

Source: MLIST
Type: Vendor Advisory
[MediaWiki-announce] 20150810 MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10

Source: GENTOO
Type: UNKNOWN
GLSA-201510-05

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-6729

Vulnerable Configuration:

Configuration 1:

cpe:/a:mediawiki:mediawiki:*:*:*:*:*:*:*:* (Version <= 1.23.9)

OR cpe:/a:mediawiki:mediawiki:1.24.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.24.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.24.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.25.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.25.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mediawiki:mediawiki:1.23.9:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.24.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.25.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.artful:def:20156729000	V	CVE-2015-6729 on Ubuntu 17.10 (artful) - medium.	2015-09-01
oval:com.ubuntu.bionic:def:201567290000000	V	CVE-2015-6729 on Ubuntu 18.04 LTS (bionic) - medium.	2015-09-01
oval:com.ubuntu.bionic:def:20156729000	V	CVE-2015-6729 on Ubuntu 18.04 LTS (bionic) - medium.	2015-09-01
oval:com.ubuntu.precise:def:20156729000	V	CVE-2015-6729 on Ubuntu 12.04 LTS (precise) - medium.	2015-09-01
oval:com.ubuntu.trusty:def:20156729000	V	CVE-2015-6729 on Ubuntu 14.04 LTS (trusty) - medium.	2015-09-01

BACK