CVE-2012-4378

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853417Issue Tracking, Patch, Third Party Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
https://phabricator.wikimedia.org/T39587Issue Tracking, Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=853417Issue Tracking, Patch, Third Party Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
https://phabricator.wikimedia.org/T39587Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Oct 26, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-43796.5MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to CVE-2012-43807.5MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create CVE-2012-43818.1MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependen CVE-2012-43824.9MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read CVE-2012-43838.8contao prior to 2.11.4 has a sql injection vulnerability CVE-2012-43846.1letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar CVE-2012-43856.5letodms 3.3.6 has CSRF via change password CVE-2012-43866.8The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allo CVE-2012-43875.0Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is CVE-2012-43884.3The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequenc CVE-2012-43896.8Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploadin CVE-2012-43904.0(1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to