Vulnerability Description
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | >= 1.19.0, < 1.19.8 |
Related Weaknesses (CWE)
References
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htMailing ListPatchVendor Advisory
- http://seclists.org/oss-sec/2013/q3/553Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/62194Third Party AdvisoryVDB Entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=52746ExploitIssue TrackingPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86897Third Party AdvisoryVDB Entry
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htMailing ListPatchVendor Advisory
- http://seclists.org/oss-sec/2013/q3/553Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/62194Third Party AdvisoryVDB Entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=52746ExploitIssue TrackingPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86897Third Party AdvisoryVDB Entry
FAQ
What is CVE-2013-4303?
CVE-2013-4303 is a vulnerability with a CVSS score of 6.1 (MEDIUM). includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even numbe...
How severe is CVE-2013-4303?
CVE-2013-4303 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4303?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki.