{"id":"CVE-2013-6452","aliases":["DEBIAN-CVE-2013-6452","DSA-2891-1","EUVD-2013-6259","GHSA-q2x4-v7h3-phvm","MGASA-2014-0113","UBUNTU-CVE-2013-6452"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1...","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01007,"percentile":0.63266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-03-02T20:53:30Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.10+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.10+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.10+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.10+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.10+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.14+dfsg-0+deb7u1"}]}],"versions":["1:1.19.10+dfsg-1","1:1.19.11+dfsg-0+deb7u1","1:1.19.11+dfsg-1","1:1.19.12+dfsg-1","1:1.19.13+dfsg-1","1:1.19.5-1","1:1.19.5-1+deb7u1","1:1.19.6-1","1:1.19.7+dfsg-1","1:1.19.7+dfsg-1.1","1:1.19.8+dfsg-1","1:1.19.8+dfsg-2","1:1.19.8+dfsg-2.1","1:1.19.8+dfsg-2.2","1:1.19.9+dfsg-1","1:1.19.9+dfsg-2"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"mediawiki-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5~deb7u1"}]}],"versions":["2.11","3.0","3.1","3.2","3.3","3.4","3~exp1","3~exp2","3~exp3"],"bundled":11},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki-ldapauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0f-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1.1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki-ldapauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0f-1.1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-1.1.mga4"}]}],"bundled":5}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6452"},{"url":"https://github.com/advisories/GHSA-q2x4-v7h3-phvm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-6452","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12337","tags":["report"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127027.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html","tags":["web"]},{"url":"http://www.mediawiki.org/wiki/Extension:GraphViz","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-6452","tags":["report"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=57550","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6452","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-6452","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2014-05-12T14:00:00Z","modified":"2024-08-06T17:39:01.306Z","updated_at":"2026-11-02T14:34:57.195423Z"}],"euvd":[{"id":"EUVD-2013-6259","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2014-05-12T14:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-q2x4-v7h3-phvm","title":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1...","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2022-05-17T04:44:25Z","modified":"2023-01-28T05:02:22Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:45.797636Z"}],"nvd":[{"id":"CVE-2013-6452","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2014-05-12T14:55:06.15Z","modified":"2026-06-17T00:00:31.313Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"CVE-2013-6452","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2014-05-12T14:55:06Z","modified":"2026-04-16T06:26:12.04207009Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-6452","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"published","published":"2014-05-12T14:55:06.15Z","modified":"2026-09-01T20:03:19.011970554Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2891-1","title":"mediawiki - security update","status":"published","published":"2014-03-30T00:00:00Z","modified":"2026-03-09T01:19:00.25627Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0113","title":"Updated mediawiki packages fix security vulnerabilities","description":"MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed\ninsertion of escaped CSS values which could pass the CSS validation checks,\nresulting in XSS (CVE-2013-6451).\n\nChris from RationalWiki reported that SVG files could be uploaded that\ninclude external stylesheets, which could lead to XSS when an XSL was used\nto include JavaScript (CVE-2013-6452).\n\nDuring internal review, it was discovered that MediaWiki's SVG sanitization\ncould be bypassed when the XML was considered invalid (CVE-2013-6453).\n\nDuring internal review, it was discovered that MediaWiki displayed some\ninformation about deleted pages in the log API, enhanced RecentChanges, and\nuser watchlists (CVE-2013-6472).\n\nNetanel Rubin from Check Point discovered a remote code execution\nvulnerability in MediaWiki's thumbnail generation for DjVu files. Internal\nreview also discovered similar logic in the PdfHandler extension, which\ncould be exploited in a similar way (CVE-2014-1610).\n\nMediaWiki has been updated to version 1.22.2, which fixes these issues, as\nwell as several others.\n\nAlso, the mediawiki-ldapauthentication and mediawiki-math extensions have\nbeen updated to newer versions that are compatible with MediaWiki 1.22.\n\nAdditionally, the mediawiki-graphviz extension has been obsoleted, due to\nthe fact that it is unmaintained upstream and is vulnerable to cross-site\nscripting attacks.\n\nNote: if you were using the \"instances\" feature in these packages to\nsupport multiple wiki instances, this feature has now been removed.  You\nwill need to maintain separate wiki instances manually.\n","status":"published","published":"2014-03-02T20:53:30Z","modified":"2026-04-16T06:22:54.196807544Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-6452","description":"Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.","status":"withdrawn","published":"2014-05-12T14:55:00Z","modified":"2025-07-16T07:31:29.070024Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}