high7.5
CVE-2017-8815
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Impact
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | through 1.27.3 Versions 1.28.0, 1.28.1, 1.28.2, 1.29.0, 1.29.1 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securitytracker.com/id/1039812
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html
- https://www.debian.org/security/2017/dsa-4036
- http://www.securitytracker.com/id/1039812
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html
- https://www.debian.org/security/2017/dsa-4036