MediaWiki contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'filter' parameter upon submission to the 'profileinfo.php' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Upgrade to version 1.16.0, 1.15.5 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Unknown or Incomplete

• CVE ID: 2010-2788 (see also: NVD)
• Secunia Advisory ID: 40740 44424 49649
• Bugtraq ID: 42024
• Related OSVDB ID: 66651
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
  http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
• Other Advisory URL: http://openwall.com/lists/oss-security/2010/07/29/4
• Vendor Specific News/Changelog Entry: http://security.gentoo.org/glsa/glsa-201206-09.xml
  http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952
  http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984
  https://bugzilla.redhat.com/show_bug.cgi?id=620225
  https://bugzilla.redhat.com/show_bug.cgi?id=620226
  https://bugzilla.wikimedia.org/show_bug.cgi?id=24565

Unknown or Incomplete