Beveiligingsadvies

CVE-2014-2242

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2014-03-02 02:00:00

Laatst bijgewerkt 2024-08-06 10:06:00

Toegewezen door mitre

CVSS-score geen score

Status PUBLISHED

Beschrijving

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

← Alle CVE's bekijken Bekijk op cve.org ↗