CVE-2013-4307

Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow (1) remote attackers to inject arbitrary web script or HTML via a label in the "In other languages" section or (2) remote administrators to inject arbitrary web script or HTML via a description.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html	Patch
http://osvdb.org/96907
http://seclists.org/oss-sec/2013/q3/553	Patch
http://www.securityfocus.com/bid/62201	Patch
https://bugzilla.wikimedia.org/show_bug.cgi?id=53472	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86892
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html	Patch
http://osvdb.org/96907
http://seclists.org/oss-sec/2013/q3/553	Patch
http://www.securityfocus.com/bid/62201	Patch
https://bugzilla.wikimedia.org/show_bug.cgi?id=53472	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86892

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mediawiki:mediawiki:1.19:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19:beta_1::::::
	cpe:2.3:a:mediawiki:mediawiki:1.19:beta_2::::::
	cpe:2.3:a:mediawiki:mediawiki:1.19.0:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.1:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.2:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.3:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.4:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.5:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.6:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.19.7:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.1:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.2:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.3:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.4:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.5:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.20.6:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.21:::::::*
	cpe:2.3:a:mediawiki:mediawiki:1.21.1:::::::*

History

21 Nov 2024, 01:55

Type	Values Removed	Values Added
References	~~() http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - Patch~~	() http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - Patch
References	~~() http://osvdb.org/96907 -~~	() http://osvdb.org/96907 -
References	~~() http://seclists.org/oss-sec/2013/q3/553 - Patch~~	() http://seclists.org/oss-sec/2013/q3/553 - Patch
References	~~() http://www.securityfocus.com/bid/62201 - Patch~~	() http://www.securityfocus.com/bid/62201 - Patch
References	~~() https://bugzilla.wikimedia.org/show_bug.cgi?id=53472 - Patch~~	() https://bugzilla.wikimedia.org/show_bug.cgi?id=53472 - Patch
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/86892 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/86892 -

Information

Published : 2013-09-12 13:30

Updated : 2024-11-21 01:55

NVD link : CVE-2013-4307

Mitre link : CVE-2013-4307

CVE.ORG link : CVE-2013-4307

JSON object : View

Products Affected

mediawiki

mediawiki

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

4.3 /10