CVE-2010-1189
MEDIUM severity · CVSS 5 · Improper input validation
5CVSS MEDIUM
Summary
MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue."
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)2%
AV:N/AC:L/Au:N/C:P/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html ↗
Additional information
- NVD record
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.htmlPatch
- http://secunia.com/advisories/39022Advisory
- http://www.vupen.com/english/advisories/2010/0685Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
- http://secunia.com/advisories/39656
- http://www.debian.org/security/2010/dsa-2022
- http://www.vupen.com/english/advisories/2010/1001