mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-17 03:25:46 +00:00
Document mediawiki -- cross site scripting vulnerability, our port versions
had not been updated yet, 1.8.x is not vulnerable by default unless you are using the $wgEnableAPI = true; statement, in that case please set it to $wgEnableAPI = false; (where possible ofcourse, else upgrade to 1.8.5).
This commit is contained in:
parent
0dc1a827d6
commit
c226087002
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=199857
@ -34,6 +34,42 @@ Note: Please add new entries to the beginning of this file.
|
||||
|
||||
-->
|
||||
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
|
||||
<vuln vid="c9c14242-6843-11dc-82b6-02e0185f8d72">
|
||||
<topic>mediawiki -- cross site scripting vulnerability</topic>
|
||||
<affects>
|
||||
<package>
|
||||
<name>mediawiki</name>
|
||||
<range><lt>1.10.2</lt></range>
|
||||
</package>
|
||||
<package>
|
||||
<name>mediawiki19</name>
|
||||
<range><lt>1.9.4</lt></range>
|
||||
</package>
|
||||
</affects>
|
||||
<description>
|
||||
<body xmlns="http://www.w3.org/1999/xhtml">
|
||||
<p>The MediaWiki development team reports:</p>
|
||||
<blockquote cite="http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html">
|
||||
<p>A possible HTML/XSS injection vector in the API
|
||||
pretty-printing mode has been found and fixed.</p>
|
||||
<p>The vulnerability may be worked around in an unfixed version
|
||||
by simply disabling the API interface if it is not in use, by
|
||||
adding this to LocalSettings.php:</p>
|
||||
<p>$wgEnableAPI = false;</p>
|
||||
<p>(This is the default setting in 1.8.x.)</p>
|
||||
</blockquote>
|
||||
</body>
|
||||
</description>
|
||||
<references>
|
||||
<cvename>CVE-2007-4828</cvename>
|
||||
<url>http://lists.wikimedia.org/pipermail/mediawiki-announce/2007-September/000067.html</url>
|
||||
</references>
|
||||
<dates>
|
||||
<discovery>2007-09-10</discovery>
|
||||
<entry>2007-09-21</entry>
|
||||
</dates>
|
||||
</vuln>
|
||||
|
||||
<vuln vid="63347ee7-6841-11dc-82b6-02e0185f8d72">
|
||||
<topic>wordpress -- remote sql injection vulnerability</topic>
|
||||
<affects>
|
||||
|
Loading…
Reference in New Issue
Block a user