Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

MediaWiki allows script injection via crafted file upload in IE6

CVE-2011-1587 · published 15 years ago
Summary

Older versions of MediaWiki (before 1.16.4) can be tricked into running unwanted code when a specially named file is uploaded and viewed with Internet Explorer 6 or earlier. An attacker could make the wiki display their own script or HTML, potentially stealing data or altering what users see. Upgrade MediaWiki to version 1.16.4 or later, and avoid using outdated browsers for accessing the site.

What to do
  • Update debian mediawiki to version 1:1.15.5-5.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian mediawiki < 1:1.15.5-5
Fix: upgrade to 1:1.15.5-5
Debian:13 debian mediawiki < 1:1.15.5-5
Fix: upgrade to 1:1.15.5-5
Debian:14 debian mediawiki < 1:1.15.5-5
Fix: upgrade to 1:1.15.5-5
– mediawiki mediawiki <= 1.16.3
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.3
1.3.0
1.3.1
100 more version ranges
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file...
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.
References
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Apr 2011
Updated3 Nov 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2011-1587 · OSV
CVE-2011-1587 · NVD
Track software like this
Free during beta