CVE-2013-4308

EPSS 0.42%
Veröffentlicht 12.09.2013 13:31:13
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Liquidthreads Project ≫ Liquidthreads Version2.0 Updatealpha

   Mediawiki ≫ Mediawiki Version1.19
   Mediawiki ≫ Mediawiki Version1.19 Updatebeta_1
   Mediawiki ≫ Mediawiki Version1.19 Updatebeta_2
   Mediawiki ≫ Mediawiki Version1.19.0
   Mediawiki ≫ Mediawiki Version1.19.1
   Mediawiki ≫ Mediawiki Version1.19.2
   Mediawiki ≫ Mediawiki Version1.19.3
   Mediawiki ≫ Mediawiki Version1.19.4
   Mediawiki ≫ Mediawiki Version1.19.5
   Mediawiki ≫ Mediawiki Version1.19.6
   Mediawiki ≫ Mediawiki Version1.19.7
   Mediawiki ≫ Mediawiki Version1.20
   Mediawiki ≫ Mediawiki Version1.20.1
   Mediawiki ≫ Mediawiki Version1.20.2
   Mediawiki ≫ Mediawiki Version1.20.3
   Mediawiki ≫ Mediawiki Version1.20.4
   Mediawiki ≫ Mediawiki Version1.20.5
   Mediawiki ≫ Mediawiki Version1.20.6
   Mediawiki ≫ Mediawiki Version1.21
   Mediawiki ≫ Mediawiki Version1.21.1

Liquidthreads Project ≫ Liquidthreads Version2.1 Updatealpha

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.42%	0.612

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

Patch

http://seclists.org/oss-sec/2013/q3/553

Patch

http://osvdb.org/96906

http://www.securityfocus.com/bid/62218

https://bugzilla.wikimedia.org/show_bug.cgi?id=53320

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/86891

https://nvd.nist.gov/vuln/detail/CVE-2013-4308

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-4308

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-4308

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2013-4308