| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | = 1.1.0= 1.10.0= 1.10.1= 1.10.2= 1.10.3= 1.10.4= 1.11= 1.11.0= 1.11.1= 1.11.2= 1.12.0= 1.12.1= 1.12.2= 1.12.3= 1.12.4= 1.13.0= 1.13.1= 1.13.2= 1.13.3= 1.13.4= 1.14.0= 1.14.1= 1.15.0= 1.15.1= 1.15.2= 1.15.3= 1.15.4= 1.15.5= 1.16.0= 1.16.1= 1.16.2= 1.17= 1.17.0= 1.17.1= 1.17.2= 1.17.3= 1.17.4= 1.18= 1.18.0= 1.18.1= 1.18.2= 1.18.3= 1.19= 1.19.0= 1.19.1= 1.19.2= 1.19.3= 1.19.4= 1.20.1= 1.20.2= 1.20.3= 1.20.4≤ 1.19.5 |
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free