PT-2019-6942 · Wikimedia · Mediawiki

Bzimport · Publicado 2013-09-13 · Atualizado 2019-12-19 · CVE-2013-4303

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.7 MediaWiki versions 1.20.x through 1.20.6 MediaWiki versions 1.21.x through 1.21.1

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks. This is achieved via the siprop parameter in a query action to "wiki/api.php". The problem arises when there is an even number of "." (period) characters in a string, which is not properly detected by the MediaWiki API.

Recommendations For MediaWiki versions 1.19.x through 1.19.7, update to version 1.19.8 or later. For MediaWiki versions 1.20.x through 1.20.6, update to version 1.20.7 or later. For MediaWiki versions 1.21.x through 1.21.1, update to version 1.21.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4303

MGASA-2013-0276

Produtos afetados

Mediawiki

Referências · 19

• 🔥 https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 · Exploit
• https://osv.dev/vulnerability/MGASA-2013-0276 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4303 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-4303 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4303 · Nota
• https://mediawiki.org/wiki/Release_notes/1.20 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-4303 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4303 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-4303 · Nota de Segurança
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2013-0276.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-4303 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86897 · Nota
• http://seclists.org/oss-sec/2013/q3/553 · Nota
• https://phabricator.wikimedia.org/T54746 · Nota