{"id":"CVE-2016-6333","aliases":["DEBIAN-CVE-2016-6333","EUVD-2016-7260","GHSA-hxwm-9f7g-wg4h","MGASA-2016-0305"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki...","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01016,"percentile":0.63528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-09-16T09:27:13Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.15-1.mga5"}]}],"bundled":6}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://phabricator.wikimedia.org/T133147","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/98053","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6333"},{"url":"https://github.com/advisories/GHSA-hxwm-9f7g-wg4h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6333","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0305.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19252","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6333","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2017-04-20T17:00:00Z","modified":"2024-08-06T01:29:19.303Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7260","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2017-04-20T17:00:00Z","modified":"2024-08-06T01:29:19Z","updated_at":"2026-11-03T02:22:39.91691Z"}],"ghsa":[{"id":"GHSA-hxwm-9f7g-wg4h","title":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki...","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2022-05-17T02:47:20Z","modified":"2023-01-27T05:05:45Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:45.476861Z"}],"nvd":[{"id":"CVE-2016-6333","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2017-04-20T17:59:00.633Z","modified":"2026-06-17T00:50:50.727Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-6333","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2017-04-20T17:59:00.633Z","modified":"2026-10-24T10:30:33.871647501Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6333","description":"Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.","status":"published","published":"2017-04-20T17:59:00.633Z","modified":"2026-09-22T07:01:05.273812319Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"MGASA-2016-0305","title":"Updated mediawiki packages fix security vulnerability","description":"Check read permission when loading page content in ApiParse\n(CVE-2016-6331)\n\nMake blocks log users out if $wgBlockDisablesLogin is true (CVE-2016-6332)\n\nMake $wgBlockDisablesLogin also restrict logged in permissions\n(CVE-2016-6332)\n\nRequire login to preview user CSS pages (CVE-2016-6333)\n\nEscape '\u003c' and ']]\u003e' in inline \u003cstyle\u003e blocks (CVE-2016-6333)\n\nXSS in unclosed internal links (CVE-2016-6334)\n\nAPI: Generate head items in the context of the given title (CVE-2016-6335)\n\nDo not allow undeleting a revision deleted file if it is the top file\n(CVE-2016-6336)\n\nThe mediawiki package has been updated to version 1.23.15, which contains\nthe above fixes.\n","status":"published","published":"2016-09-16T09:27:13Z","modified":"2026-04-16T06:25:32.876729138Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}