Description (CNA)
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.securityfocus.com/bid/98057
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1369613
- https://phabricator.wikimedia.org/T137264
ADP enrichment
No English description supplied.