CVE-2007-4828
Vulnerability from cvelistv5
Published
2007-09-12 19:00
Modified
2024-08-07 15:08
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
secalert@redhat.comhttp://fedoranews.org/updates/FEDORA-2007-218.shtml
secalert@redhat.comhttp://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.htmlPatch
secalert@redhat.comhttp://secunia.com/advisories/26772Patch, Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/26870
secalert@redhat.comhttp://www.securityfocus.com/bid/25632
secalert@redhat.comhttp://www.vupen.com/english/advisories/2007/3130
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=287881
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/36558
af854a3a-2127-422b-91ae-364da2661108http://fedoranews.org/updates/FEDORA-2007-218.shtml
af854a3a-2127-422b-91ae-364da2661108http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26772Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26870
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/25632
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/3130
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=287881
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/36558
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:08:33.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "25632",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25632"
          },
          {
            "name": "ADV-2007-3130",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3130"
          },
          {
            "name": "FEDORA-2007-2189",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://fedoranews.org/updates/FEDORA-2007-218.shtml"
          },
          {
            "name": "mediawiki-prettyprinting-xss(36558)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36558"
          },
          {
            "name": "26772",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26772"
          },
          {
            "name": "[MediaWiki-announce] 20070910 MediaWiki 1.11.0, 1.10.2, 1.9.4, 1.8.5 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html"
          },
          {
            "name": "26870",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26870"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=287881"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-09-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-28T12:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "25632",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25632"
        },
        {
          "name": "ADV-2007-3130",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3130"
        },
        {
          "name": "FEDORA-2007-2189",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://fedoranews.org/updates/FEDORA-2007-218.shtml"
        },
        {
          "name": "mediawiki-prettyprinting-xss(36558)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36558"
        },
        {
          "name": "26772",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26772"
        },
        {
          "name": "[MediaWiki-announce] 20070910 MediaWiki 1.11.0, 1.10.2, 1.9.4, 1.8.5 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html"
        },
        {
          "name": "26870",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26870"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=287881"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2007-4828",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "25632",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25632"
            },
            {
              "name": "ADV-2007-3130",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3130"
            },
            {
              "name": "FEDORA-2007-2189",
              "refsource": "FEDORA",
              "url": "http://fedoranews.org/updates/FEDORA-2007-218.shtml"
            },
            {
              "name": "mediawiki-prettyprinting-xss(36558)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36558"
            },
            {
              "name": "26772",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26772"
            },
            {
              "name": "[MediaWiki-announce] 20070910 MediaWiki 1.11.0, 1.10.2, 1.9.4, 1.8.5 released",
              "refsource": "MLIST",
              "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html"
            },
            {
              "name": "26870",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26870"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=287881",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=287881"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-4828",
    "datePublished": "2007-09-12T19:00:00",
    "dateReserved": "2007-09-12T00:00:00",
    "dateUpdated": "2024-08-07T15:08:33.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2007-4828\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2007-09-12T19:17:00.000\",\"lastModified\":\"2024-11-21T00:36:32.780\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el modo de presentaci\u00f3n legible para humanos (pretty-printing) de la API de MediaWiki 1.8.0 hasta 1.8.4, 1.9.0 hasta 1.9.3, 1.10.0 hasta 1.10.1, y las versiones de desarrollo hasta la 1.11.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46046B16-3EE4-42C0-BA77-73300A641BA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"136E5FD9-C0A0-4970-8852-D97C5BC723E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5FD2871-90BB-4AFA-89D0-B9B5BE365771\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D35193-8AF8-4CB9-A47D-A58DE389515E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E1CD7D7-546A-48FA-9C4C-1FB0CA22C6FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B40FB49B-1E96-44BC-A9B0-9BDB28F858A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3A0921C-BEC5-4646-96FD-0529828B5BAC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.9.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB4E8709-43E2-4ADC-8759-16AC265658C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.9.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0A8A1D30-57E7-4010-B68A-8D22EA091FF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0983C0E-9035-4256-AC99-C2C81C1634E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.10.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5460DB30-FA14-4017-BC8B-15F9451469F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.11_development:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BAC8B28-1EF1-47A3-831E-84ABC8974780\"}]}]}],\"references\":[{\"url\":\"http://fedoranews.org/updates/FEDORA-2007-218.shtml\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"http://secunia.com/advisories/26772\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26870\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/25632\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/3130\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=287881\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/36558\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://fedoranews.org/updates/FEDORA-2007-218.shtml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://secunia.com/advisories/26772\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/26870\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/25632\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2007/3130\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=287881\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/36558\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.