CVE-2008-1318

Published: Mar 13, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results.

Affected (2)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Version 1.11.1
Mediawiki Mediawiki	Version 1.11

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-March/000070.html

Source: cve@mitre.org

Patch

http://secunia.com/advisories/29216

Source: cve@mitre.org

PatchVendor Advisory

http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_11_2/phase3/RELEASE-NOTES

Source: cve@mitre.org

http://www.securityfocus.com/bid/28070

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1019535

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0732/references

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/40960

Source: cve@mitre.org

http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-March/000070.html