CVE-2011-1579
EPSS 1.9%
描述
The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.
如何修補 CVE-2011-1579
要修補 CVE-2011-1579,請將受影響套件升級到下列已修補版本。
- Debian/mediawiki—升級至 1:1.15.5-5 或更新版本
CVE-2011-1579 正在被利用嗎?
低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1:1.15.5-5