Description

includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.

Remediation

References

CVE-2013-4303

Related Vulnerabilities

PHP Other Vulnerability (CVE-2004-0959)

Drupal CVE-2018-7602 Vulnerability (CVE-2018-7602)

Drupal Core 9.3.x Security Bypass (9.3.0 - 9.3.13)

WebERP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-19435)

Oracle Database Server CVE-2012-0526 Vulnerability (CVE-2012-0526)

Severity

Medium

Classification

CVE-2013-4303 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities