NVD

Id
8509  
Name
CVE-2011-1579  
Description
The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the 2f2a and 2a2f hex strings to surround CSS comments.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-04-26  
Modified Date
2012-09-14  
Seq
2011-1579  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
48905 8509 CVE-2011-1579 FEDORA-2011-5495  View
48906 8509 CVE-2011-1579 FEDORA-2011-5848  View
48907 8509 CVE-2011-1579 FEDORA-2011-5812  View
48908 8509 CVE-2011-1579 FEDORA-2011-5807  View
48909 8509 CVE-2011-1579 [mediawiki-announce] 20110412 MediaWiki security release 1.16.3  View
48910 8509 CVE-2011-1579 [oss-security] 20110413 Re: CVE request: mediawiki 1.16.3  View
48911 8509 CVE-2011-1579 DSA-2366  View
48912 8509 CVE-2011-1579 http://www.mediawiki.org/wiki/Special:Code/MediaWiki/85856  View
48913 8509 CVE-2011-1579 47354  View
48914 8509 CVE-2011-1579 ADV-2011-0978  View
48915 8509 CVE-2011-1579 ADV-2011-1100  View
48916 8509 CVE-2011-1579 ADV-2011-1151  View
48917 8509 CVE-2011-1579 mediawiki-css-data-xss(66738)  View
48918 8509 CVE-2011-1579 https://bugzilla.redhat.com/show_bug.cgi?id=695577  View
48919 8509 CVE-2011-1579 https://bugzilla.redhat.com/show_bug.cgi?id=696360  View
48920 8509 CVE-2011-1579 https://bugzilla.wikimedia.org/show_bug.cgi?id=28450  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34210 JVNDB-2011-004452 MediaWiki の checkCss 関数における重要な情報を取得される脆弱性 MediaWiki の wikitext パーサーの includes/Sanitizer.php の checkCss 関数は、Cascading Style Sheets (CSS) のトークンシーケンスを適切に検証しないため、クロスサイトスクリプティング攻撃を実行される、または重要な情報を取得される脆弱性が存在します。 CVE-2011-1579 49486 CVE-2011-1579 8509 5.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004452.html 2011-04-26 2012-03-27 View