Vulnerability CVE-2013-6452

Vulnerability Name:

CVE-2013-6452 (CCN-90601)

Assigned:

2013-11-04

Published:

2014-01-14

Updated:

2014-05-13

Summary:

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-79

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2013-6452

Source: CCN
Type: MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10
[MediaWiki-announce] MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10

Source: MLIST
Type: Patch, Vendor Advisory
[MediaWiki-announce] 20140114 MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10

Source: CCN
Type: SA56413
MediaWiki Security Issues and Multiple Vulnerabilities

Source: CCN
Type: MediaWiki Web site
MediaWiki

Source: CCN
Type: BID-65003
MediaWiki Multiple Security Vulnerabilities

Source: CCN
Type: BID-65883
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability

Source: XF
Type: UNKNOWN
mediawiki-cve20136452-xss(90601)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-6452

Vulnerable Configuration:

Configuration 1:

cpe:/a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:mediawiki:mediawiki:1.21:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:mediawiki:mediawiki:1.19:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19:beta_1:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19:beta_2:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.19.8:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:*:*:*:*:*:*:*:* (Version <= 1.19.9)

Configuration CCN 1:

cpe:/a:mediawiki:mediawiki:1.19.9:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*

OR cpe:/a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:29092	P	DSA-2891-3 -- mediawiki, mediawiki-extensions -- security update	2015-08-17
oval:org.mitre.oval:def:29025	P	DSA-2891-2 -- mediawiki, mediawiki-extensions -- security update	2015-08-17
oval:org.mitre.oval:def:24466	P	DSA-2891-1 mediawiki - security update	2014-06-23
oval:com.ubuntu.precise:def:20136452000	V	CVE-2013-6452 on Ubuntu 12.04 LTS (precise) - medium.	2014-05-12
oval:com.ubuntu.trusty:def:20136452000	V	CVE-2013-6452 on Ubuntu 14.04 LTS (trusty) - medium.	2014-05-12

BACK