« Volver al listado

CVE-2015-6730

Estado: ModificadaMedia (4.3)—

Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro f, el cual no es manejado correctamente en una página de error, relacionado con 'ForeignAPI images'.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mediawiki — Mediawiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-6730",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-09-01T14:59:08.400",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/08/12/6",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/08/27/6",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/76334",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201510-05",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/08/12/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/08/27/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/76334",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201510-05",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to \"ForeignAPI images.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en thumb.php en MediaWiki en versiones anteriores 1.23.10, 1.24.x en versiones anteriores 1.24.3 y 1.25.x en versiones anteriores a 1.25.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro f, el cual no es manejado correctamente en una página de error, relacionado con 'ForeignAPI images'."
    }
  ],
  "lastModified": "2026-06-17T00:31:19.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05064578-51CC-482B-A135-42522AA50F0A",
              "versionEndIncluding": "1.23.9"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B21EB21-AE87-48BF-B4A1-5E63A2E116B4"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.24.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6C00423-B3FE-485A-9014-22F409DBD377"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E90C95FB-71CA-4CA1-935D-58A08244A81F"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.25.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9129F374-93CB-43CE-A3B2-DB6483514F32"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.25.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE125142-10A2-4ACF-9BA4-44E63C1E5DB6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}