Test ID:	1.3.6.1.4.1.25623.1.0.805328
Category:	Web application abuses
Title:	MediaWiki TemplateSandbox Extension < 1.24 XSS Vulnerability (Jan 2015) - Active Check
Summary:	The TemplateSandbox extension for MediaWiki is prone to a; cross-site scripting (XSS) vulnerability.
Description:	Summary: The TemplateSandbox extension for MediaWiki is prone to a cross-site scripting (XSS) vulnerability. Vulnerability Insight: The flaw exists as input passed via text parameter to the 'Extension:TemplateSandbox' script is not validated before returning it to users. Vulnerability Impact: Successful exploitation will allow remote attacker to execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. Affected Software/OS: The TemplateSandbox extension for Mediawiki in versions prior to 1.24. Solution: Update the TemplateSandbox extension to version 1.24 or later. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-9479 https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html http://www.openwall.com/lists/oss-security/2014/12/21/2 http://www.openwall.com/lists/oss-security/2015/01/03/13
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.