« Back to list

CVE-2017-8811

Status: ModifiedMedium (6.1)—

The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Debian — Debian LinuxMediawiki — Mediawiki

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-8811",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2",
          "versions": [
            {
              "status": "affected",
              "version": "MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-15T08:29:00.720",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1039812",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html",
      "tags": [
        "Mailing List",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://www.debian.org/security/2017/dsa-4036",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039812",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html",
      "tags": [
        "Mailing List",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2017/dsa-4036",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks."
    },
    {
      "lang": "es",
      "value": "La implementación de la expansión del parámetro raw message en MediaWiki en versiones anteriores a la 1.27.4; las versiones 1.28.x anteriores a la 1.28.3 y las versiones 1.29.x anteriores a la 1.29.2 permite ataques de decoración HTML."
    }
  ],
  "lastModified": "2026-06-17T01:27:00.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2825F885-DD77-4822-B659-D5AFB56C6B17",
              "versionEndIncluding": "1.27.3"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.28.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70CAB8A9-39D5-41F4-800C-79E4FE57B12D"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.28.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A060BA59-05C8-4646-97D7-4F382B4EBCC6"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.28.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E67B837B-D085-4EE4-9556-D25BFA9BC108"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.29.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFA5659C-9DEA-494E-BB32-E6573E180C26"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.29.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A457BE6-9F2F-45C9-A650-46F7E4B77E20"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}