Input validation error in MediaWiki - CVE-2013-6453

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41691

Input validation error in MediaWiki - CVE-2013-6453

Published: May 12, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41691
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-6453
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.


Affected software

MediaWiki
Gentoo Linux
Fedora
mediawiki119

How to mitigate CVE-2013-6453

Install update from vendor's website.

mediawiki119 - addressed in versions 1.19.10-1.el6, 1.19.11-2.el5

External References

Related Security Bulletins