CVE-2013-6452: XSS
Published May 12, 2014
·Updated
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.
Affected Software
18 affected components
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki<=1.19.9
MediaWiki MediaWiki=1.19
MediaWiki MediaWiki=1.19-beta_1
MediaWiki MediaWiki=1.19-beta_2
MediaWiki MediaWiki=1.19.0
MediaWiki MediaWiki=1.19.1
MediaWiki MediaWiki=1.19.2
MediaWiki MediaWiki=1.19.3
MediaWiki MediaWiki=1.19.4
MediaWiki MediaWiki=1.19.5
MediaWiki MediaWiki=1.19.6
MediaWiki MediaWiki=1.19.7
MediaWiki MediaWiki=1.19.8
Remediation
Event History
May 12, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-6452?
CVE-2013-6452 has a medium severity rating allowing for cross-site scripting attacks.
2
How do I fix CVE-2013-6452?
To fix CVE-2013-6452, upgrade MediaWiki to version 1.19.10 or later, 1.21.4 or later, or 1.22.1 or later.
3
Who is affected by CVE-2013-6452?
CVE-2013-6452 affects users of MediaWiki versions prior to 1.19.10, 1.21.4, and 1.22.1.
4
What type of attack can CVE-2013-6452 facilitate?
CVE-2013-6452 can facilitate cross-site scripting (XSS) attacks allowing arbitrary web scripts to be injected.
5
In which versions of MediaWiki is CVE-2013-6452 present?
CVE-2013-6452 is present in MediaWiki versions 1.19.x before 1.19.10, 1.21.x before 1.21.4, and 1.22.x before 1.22.1.