SemanticMediaWiki/SemanticResultFormats

[Exhibit format] Vulnerable JQuery implementation (CVE-2012-6708)

infecticide opened this issue · 6 comments

infecticide commented

Setup

  • SMW version: 6.0.1
  • MW version: 1.37.2
  • PHP version: 8.0.27
  • DB system (MySQL, Blazegraph, etc.) and version: MariaDB 10.6.11

Issue

Detailed description of the issue and a stack trace if applicable:

Greenbone security scanner (OpenVAS) has detected an outdated JQuery library that is vulnerable to XSS attacks.

CVE-2012-6708 ( )

File detected /var/www/redacted/mediawiki-1.37.2/extensions/SemanticResultFormats/formats/Exhibit/ajax/scripts/jquery-1.3.2.min.js

Steps to reproduce the observation (recommendation is to use the sandbox):
Run an authenticated OpenVAS scan against a web server containing Mediawiki with the SemanticWiki extensions.

malberts commented

The error suggests this is in https://github.com/SemanticMediaWiki/SemanticResultFormats, not SemanticMediaWiki.

infecticide commented

Sorry I assumed since that extension comes with the source that it was part of this repo. I see now that this belongs elsewhere.

kghbln commented

We have the option to transfer an issue within the organization. I assume that it is still an issue, thus reopening.

infecticide commented

After closing this and searching over here instead, I see that the Exhibit report format is disabled by default and is actually being removed from future versions due to the this same issue.

See #448

infecticide commented

To mitigate this for now, I have deleted the "SemanticResultFormats/formats/Exhibit" directory from my installation.

kghbln commented

Ah, exhibit. I should have seen this. Thanks!