PT-2013-4950 · Wikimedia · Mediawiki

Liangent · Published 2013-09-11 · Updated 2017-08-29 · CVE-2013-4307

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.19.x through 1.19.7 MediaWiki versions 1.20.x through 1.20.6 MediaWiki versions 1.21.x through 1.21.1

Description The issue allows remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section. Additionally, remote administrators can inject arbitrary web script or HTML via a description. This is due to multiple cross-site scripting (XSS) vulnerabilities in the Wikibase extension.

Recommendations For MediaWiki versions 1.19.x through 1.19.7, update to version 1.19.8 or later. For MediaWiki versions 1.20.x through 1.20.6, update to version 1.20.7 or later. For MediaWiki versions 1.21.x through 1.21.1, update to version 1.21.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-4307

Affected Products

Mediawiki

References · 8

• https://bugzilla.wikimedia.org/show_bug.cgi?id=53472 · Patch
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html · Patch
• http://securityfocus.com/bid/62201 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-4307 · Security Note
• http://seclists.org/oss-sec/2013/q3/553 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4307 · Note
• http://osvdb.org/96907 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86892 · Note