CVE-2006-2895

Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-June/000048.html	Patch
http://secunia.com/advisories/20458	Patch Vendor Advisory
http://svn.wikimedia.org/viewvc/mediawiki/tags/REL1_6_7/phase3/RELEASE-NOTES	Patch
http://www.vupen.com/english/advisories/2006/2159
https://exchange.xforce.ibmcloud.com/vulnerabilities/27029

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mediawiki:mediawiki:1.6.0:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.1:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.2:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.3:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.4:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.5:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.5_r14348:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.6.6:::::::*

History

No history.

Information

Published : 2006-06-07 10:02

Updated : 2017-07-20 01:31

NVD link : CVE-2006-2895

Mitre link : CVE-2006-2895

CVE.ORG link : CVE-2006-2895

JSON object : View

Products Affected

mediawiki

mediawiki

CWE

NVD-CWE-Other

{"id": "CVE-2006-2895", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2006-06-07T10:02:00.000", "references": [{"url": "http://mail.wikipedia.org/pipermail/mediawiki-announce/2006-June/000048.html", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/20458", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://svn.wikimedia.org/viewvc/mediawiki/tags/REL1_6_7/phase3/RELEASE-NOTES", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/2159", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27029", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form."}], "lastModified": "2017-07-20T01:31:52.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3EAF847-B64C-4C12-8BF2-631F61B0618E"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09EF3827-9C87-4043-B10A-1D6AFCB64F57"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08B1EDE8-940E-47C1-9CDA-C6BBE1BB9A11"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4554900-E09D-4D9D-99D4-FE5FDB3CDE78"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93EB0312-A147-4307-9491-46AEC2EC727C"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48929086-E08E-472D-A503-4CA803A840D5"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.5_r14348:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62B4D1E6-9EFE-4608-9A97-8119822A9F3B"}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A98675FD-C9EA-49AB-BA9F-2CF5898203C7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}