PT-2013-4950 · Wikimedia · Mediawiki

Liangent · Publicado 2013-09-11 · Atualizado 2017-08-29 · CVE-2013-4307

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.7 MediaWiki versions 1.20.x through 1.20.6 MediaWiki versions 1.21.x through 1.21.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section. Additionally, remote administrators can inject arbitrary web script or HTML via a description. This is due to multiple cross-site scripting (XSS) vulnerabilities in the Wikibase extension.

Recommendations For MediaWiki versions 1.19.x through 1.19.7, update to version 1.19.8 or later. For MediaWiki versions 1.20.x through 1.20.6, update to version 1.20.7 or later. For MediaWiki versions 1.21.x through 1.21.1, update to version 1.21.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4307

Produtos afetados

Mediawiki

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4307 · Nota
• https://bugzilla.wikimedia.org/show_bug.cgi?id=53472 · Correção
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html · Correção
• http://osvdb.org/96907 · Nota
• http://securityfocus.com/bid/62201 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86892 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4307 · Nota de Segurança
• http://seclists.org/oss-sec/2013/q3/553 · Correção