Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-4303

includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.

Published

2019-12-11T19:15:12.217

Last Modified

2024-11-21T01:55:18.920

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mediawiki	mediawiki	< 1.19.8	Yes
Application	mediawiki	mediawiki	< 1.20.7	Yes
Application	mediawiki	mediawiki	< 1.21.2	Yes

References

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Mailing List, Patch, Vendor Advisory ([email protected])
http://seclists.org/oss-sec/2013/q3/553 Mailing List, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/62194 Third Party Advisory, VDB Entry ([email protected])
https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 Exploit, Issue Tracking, Patch, Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/86897 Third Party Advisory, VDB Entry ([email protected])
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Mailing List, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/oss-sec/2013/q3/553 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/62194 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.wikimedia.org/show_bug.cgi?id=52746 Exploit, Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/86897 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)