CVE-2015-6732 Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Specia...
MediumCVSS 4.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit, the (2) "Template label (optional)" field in a form, or a (3) Field name in a template.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| semanticforms project semanticforms | All versions | No fix listed |
References
- FEDORA-2015-13920 vendor-advisory
- [oss-security] 20150812 CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10 mailing-list
- [oss-security] 20150827 Re: CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10 mailing-list
- 76334 vdb-entry
- [MediaWiki-announce] 20150810 MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10 mailing-list vendor-advisory
- phabricator.wikimedia.org
- phabricator.wikimedia.org
- phabricator.wikimedia.org
- GLSA-201510-05 vendor-advisory