CVE-2019-19329
MEDIUM
6,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none
MEDIUM
4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: partial
Availability: none
Description
AI Translation Available
In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0041
Percentile
0,6th
Updated
EPSS Score Trend (Last 90 Days)
79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
StableCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Integrity
Availability
Potential Impacts:
Bypass Protection Mechanism
Read Application Data
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
AI/ML, Web Based, Web Server
Application
Wikidata Query Gui by Wikimedia
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wikimedia:wikidata_query_gui:0.3.6:2019-11-07:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Wikidata Query Gui by Wikimedia
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wikimedia:wikidata_query_gui:0.3.6:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Wikidata Query Gui by Wikimedia
Version Range Affected
To
0.3.5
(inclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:wikimedia:wikidata_query_gui:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://gerrit.wikimedia.org/g/wikidata/query/gui/+/d9f964b88c01748e278ca8c4b89…
https://gerrit.wikimedia.org/r/#/c/wikidata/query/gui/+/549457/
https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001492.html
https://phabricator.wikimedia.org/T233213
https://gerrit.wikimedia.org/g/wikidata/query/gui/+/d9f964b88c01748e278ca8c4b89…
https://gerrit.wikimedia.org/r/#/c/wikidata/query/gui/+/549457/
https://lists.wikimedia.org/pipermail/wikidata-tech/2019-November/001492.html
https://phabricator.wikimedia.org/T233213