CVE-2013-4568
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x...
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
Exploit likelihood
What each source reports
NVD Score used
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
CVE-2013-4568- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
CVE-2013-4568- Updated
- 2026-11-02
EUVDEUVD-2013-4426 No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
EUVD-2013-4426- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gx65-cr9q-7fgc No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x...
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
GHSA-gx65-cr9q-7fgc- Updated
- 2026-11-02
OSV No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
CVE-2013-4568- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4568 No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
DEBIAN-CVE-2013-4568- Updated
- 2026-11-02
OSVMGASA-2013-0368 No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
Kevin Israel (Wikipedia user PleaseStand) identified and reported two vectors for injecting Javascript in CSS that bypassed MediaWiki's blacklist (CVE-2013-4567, CVE-2013-4568).
Internal review while debugging a site issue discovered that MediaWiki and the CentralNotice extension were incorrectly setting cache headers when a user was autocreated, causing the user's session cookies to be cached, and returned to other users (CVE-2013-4572).
- Record
MGASA-2013-0368- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4568 No score
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
- Record
UBUNTU-CVE-2013-4568- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:13 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:14 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:7 From an advisory covering 11 CVEs |
before 1:1.19.14+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 11 moreShow less1:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.14+dfsg-0+deb7u1 |
mediawiki-extensionsDebian:7 From an advisory covering 11 CVEs |
before 3.5~deb7u1, plus listed versions 2.113.03.13.23.3 Show 4 moreShow less3.43~exp13~exp23~exp3 |
3.5~deb7u1 |
mediawikiMageia:3 From an advisory covering 3 CVEs |
before 1.20.8-1.mga3 | 1.20.8-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4568 is a medium vulnerability (CVSS 4.3) in Mediawiki, published December 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in mediawiki 1:1.19.8+dfsg-2.2.
References
secunia.com/advisories/57472
debian.org/security/2014/dsa-2891
bugzilla.wikimedia.org/attachment.cgi?id=13452&action=diff
lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
securityfocus.com/bid/63761
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4568
github.com/advisories/GHSA-gx65-cr9q-7fgc
security-tracker.debian.org/tracker/CVE-2013-4568
advisories.mageia.org/MGASA-2013-0368.html
bugs.mageia.org/show_bug.cgi?id=11854
ubuntu.com/security/CVE-2013-4568
cve.org/CVERecord?id=CVE-2013-4568