Secunia

Moshe BA has reported a vulnerability in MediaWiki, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "rs" parameter in index.php (when "action" is set to "ajax") is not properly sanitised from UTF-7 data before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation requires that $wgUseAjax is set to true (not default setting) and that the target user uses Internet Explorer with encoding auto-detection enabled.

The vulnerability is related to:
SA23647

The vulnerability is reported in the 1.6.x branch before 1.6.10, the 1.7.x branch before 1.7.3, the 1.8.x branch before 1.8.4, and the 1.9.x branch before 1.9.3.

Solution
Update to version 1.6.10, 1.7.3, 1.8.4, or 1.9.3.

Provided and/or discovered by
Moshe BA, BugSec LTD.

Changelog
Further details available in Customer Area

Original Advisory
BugSec LTD.:
http://www.bugsec.com/articles.php?Security=24

MediaWiki:
http://svn.wikimedia.org/viewvc/mediawiki/tags/REL1_9_3/phase3/RELEASE-NOTES?revision=20016

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area