CVEvulnerability
CVE-2013-4303
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-12-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
Affected configurations
• mediawiki mediawiki (>= 1.19.0 < 1.19.8)
• mediawiki mediawiki (>= 1.20.0 < 1.20.7)
• mediawiki mediawiki (>= 1.21.0 < 1.21.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Mailing List, Patch, Vendor Advisory
- http://seclists.org/oss-sec/2013/q3/553 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/62194 Third Party Advisory, VDB Entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86897 Third Party Advisory, VDB Entry
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Mailing List, Patch, Vendor Advisory
- http://seclists.org/oss-sec/2013/q3/553 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/62194 Third Party Advisory, VDB Entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86897 Third Party Advisory, VDB Entry