CVE-2013-6454: XSS
Published May 12, 2014
·Updated
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.
Affected Software
18 affected components
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki<=1.19.9
MediaWiki MediaWiki=1.19
MediaWiki MediaWiki=1.19-beta_1
MediaWiki MediaWiki=1.19-beta_2
MediaWiki MediaWiki=1.19.0
MediaWiki MediaWiki=1.19.1
MediaWiki MediaWiki=1.19.2
MediaWiki MediaWiki=1.19.3
MediaWiki MediaWiki=1.19.4
MediaWiki MediaWiki=1.19.5
MediaWiki MediaWiki=1.19.6
MediaWiki MediaWiki=1.19.7
MediaWiki MediaWiki=1.19.8
Remediation
Event History
May 12, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-6454?
CVE-2013-6454 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2013-6454?
To fix CVE-2013-6454, upgrade MediaWiki to versions 1.19.10, 1.21.4, or 1.22.1 or later.
3
What type of vulnerability is CVE-2013-6454?
CVE-2013-6454 is a cross-site scripting (XSS) vulnerability.
4
Which versions of MediaWiki are affected by CVE-2013-6454?
MediaWiki versions before 1.19.10, 1.21.x before 1.21.4, and 1.22.x before 1.22.1 are affected by CVE-2013-6454.
5
Can CVE-2013-6454 lead to data theft?
Yes, CVE-2013-6454 can potentially lead to data theft through the injection of malicious scripts.