CVE-2013-4308

EPSS 1.29%
Veröffentlicht 12.09.2013 13:31:13
Zuletzt bearbeitet 29.04.2026 01:13:23
Erkennungen
Login

Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 9

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liquidthreads Project ≫ Liquidthreads Version 2.0 Update alpha

   Mediawiki ≫ Mediawiki Version 1.19
   Mediawiki ≫ Mediawiki Version 1.19 Update beta_1
   Mediawiki ≫ Mediawiki Version 1.19 Update beta_2
   Mediawiki ≫ Mediawiki Version 1.19.0
   Mediawiki ≫ Mediawiki Version 1.19.1
   Mediawiki ≫ Mediawiki Version 1.19.2
   Mediawiki ≫ Mediawiki Version 1.19.3
   Mediawiki ≫ Mediawiki Version 1.19.4
   Mediawiki ≫ Mediawiki Version 1.19.5
   Mediawiki ≫ Mediawiki Version 1.19.6
   Mediawiki ≫ Mediawiki Version 1.19.7
   Mediawiki ≫ Mediawiki Version 1.20
   Mediawiki ≫ Mediawiki Version 1.20.1
   Mediawiki ≫ Mediawiki Version 1.20.2
   Mediawiki ≫ Mediawiki Version 1.20.3
   Mediawiki ≫ Mediawiki Version 1.20.4
   Mediawiki ≫ Mediawiki Version 1.20.5
   Mediawiki ≫ Mediawiki Version 1.20.6
   Mediawiki ≫ Mediawiki Version 1.21
   Mediawiki ≫ Mediawiki Version 1.21.1

Liquidthreads Project ≫ Liquidthreads Version 2.1 Update alpha

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.29%	0.664

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

Patch

http://seclists.org/oss-sec/2013/q3/553

Patch

http://osvdb.org/96906

http://www.securityfocus.com/bid/62218

https://bugzilla.wikimedia.org/show_bug.cgi?id=53320

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/86891

https://nvd.nist.gov/vuln/detail/CVE-2013-4308

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-4308

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-4308

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2013-4308