Description

Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.

Remediation

References

CVE-2013-4567

Related Vulnerabilities

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-13964)

WordPress Plugin UpdraftPlus WordPress Backup Privilege Escalation (1.23.2)

WordPress Plugin White Label CMS Cross-Site Scripting (2.2.8)

Drupal Core 4.7.x HTTP Response Splitting (4.7.0 - 4.7.7)

Ruby Double Free Vulnerability (CVE-2022-28738)

Severity

Medium

Classification

CVE-2013-4567

Tags

Missing Update Known Vulnerabilities