Lucene search

MitreCVE-2015-2939

HistoryApr 13, 2015 - 2:59 p.m.

CVE-2015-2939

2015-04-1314:59:12

CWE-79

mitre

web.nvd.nist.gov

cve

2015

2939

cross-site scripting

xss

vulnerability

scribunto

extension

mediawiki

remote attackers

web script

html

lua error

backtrace

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.

Affected configurations

Nvd

Node

mediawikiscribuntoMatch-mediawiki

VendorProductVersionCPE
mediawikiscribunto-cpe:2.3:a:mediawiki:scribunto:-:*:*:*:*:mediawiki:*:*

Vendor	Product	Version	CPE
mediawiki	scribunto	-	cpe:2.3:a:mediawiki:scribunto:-:::::mediawiki::

References

www.mandriva.com/security/advisories?name=MDVSA-2015:200

www.openwall.com/lists/oss-security/2015/04/01/1

www.openwall.com/lists/oss-security/2015/04/07/3

www.securityfocus.com/bid/73477

lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

phabricator.wikimedia.org/T85113

security.gentoo.org/glsa/201510-05

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

Related for CVE-2015-2939