{"id":"CVE-2016-6334","aliases":["DEBIAN-CVE-2016-6334","EUVD-2016-7261","GHSA-9276-9qp2-vqp8","MGASA-2016-0305"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki...","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01122,"percentile":0.66434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-09-16T09:27:13Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.27.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.27.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.15-1.mga5"}]}],"bundled":6}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://www.securityfocus.com/bid/98057","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1369613","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://phabricator.wikimedia.org/T137264","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6334"},{"url":"https://github.com/advisories/GHSA-9276-9qp2-vqp8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6334","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0305.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19252","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6334","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2017-04-20T17:00:00Z","modified":"2024-08-06T01:29:19.371Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-7261","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2017-04-20T17:00:00Z","modified":"2024-08-06T01:29:19Z","updated_at":"2026-11-03T02:22:39.91691Z"}],"ghsa":[{"id":"GHSA-9276-9qp2-vqp8","title":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki...","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2022-05-17T02:47:20Z","modified":"2023-01-27T05:05:45Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:45.476861Z"}],"nvd":[{"id":"CVE-2016-6334","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2017-04-20T17:59:00.663Z","modified":"2026-06-17T00:50:50.823Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-6334","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2017-04-20T17:59:00.663Z","modified":"2026-10-24T10:31:05.811371535Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6334","description":"Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.","status":"published","published":"2017-04-20T17:59:00.663Z","modified":"2026-09-22T07:02:21.186439155Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"MGASA-2016-0305","title":"Updated mediawiki packages fix security vulnerability","description":"Check read permission when loading page content in ApiParse\n(CVE-2016-6331)\n\nMake blocks log users out if $wgBlockDisablesLogin is true (CVE-2016-6332)\n\nMake $wgBlockDisablesLogin also restrict logged in permissions\n(CVE-2016-6332)\n\nRequire login to preview user CSS pages (CVE-2016-6333)\n\nEscape '\u003c' and ']]\u003e' in inline \u003cstyle\u003e blocks (CVE-2016-6333)\n\nXSS in unclosed internal links (CVE-2016-6334)\n\nAPI: Generate head items in the context of the given title (CVE-2016-6335)\n\nDo not allow undeleting a revision deleted file if it is the top file\n(CVE-2016-6336)\n\nThe mediawiki package has been updated to version 1.23.15, which contains\nthe above fixes.\n","status":"published","published":"2016-09-16T09:27:13Z","modified":"2026-04-16T06:25:32.876729138Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}