CVE-2013-4303
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2013-4303
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2013-4303.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2013-4303
- Related
- Published
- 2019-12-11T19:15:12Z
- Modified
- 2024-12-29T17:00:03Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
- References
-
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
- http://www.securityfocus.com/bid/62194
- https://bugzilla.wikimedia.org/show_bug.cgi?id=52746
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86897
- http://seclists.org/oss-sec/2013/q3/553
- https://security-tracker.debian.org/tracker/CVE-2013-4303
Affected packages
Debian:11 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:deb/debian/mediawiki?arch=source
Debian:12 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:deb/debian/mediawiki?arch=source