PT-2013-3513 · Wikimedia+2 · Mediawiki+2

Jan Schejbal + 1 · Published 2013-11-15 · Updated 2016-12-31 · CVE-2013-2031

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.6 MediaWiki versions 1.20.x prior to 1.20.5

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks. This can be demonstrated by a CDATA section containing valid UTF-7 encoded sequences in an SVG file, which is then incorrectly interpreted as UTF-8 by browsers like Chrome and Firefox.

Recommendations For MediaWiki versions prior to 1.19.6, update to version 1.19.6 or later. For MediaWiki versions 1.20.x prior to 1.20.5, update to version 1.20.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-2031

DSA-2891-1

Affected Products

Google Chrome

Firefox

Mediawiki

References · 19

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2031 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2031 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2031 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2031 · Vendor Advisory
• http://debian.org/security/2014/dsa-2891 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html · Vendor Advisory
• http://secunia.com/advisories/55433 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201310-21.xml · Vendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html · Patch
• https://ubuntu.com/security/CVE-2013-2031 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2031 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2031 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2031 · Note