CVE-2013-4303: mediawiki Cross-site Scripting
Vulnerability summary
CVE-2013-4303 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in mediawiki. EPSS estimates a 1.53% chance of exploitation in the next 30 days, higher than 74.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 11-12-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.53%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.53% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.wikimedia.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- mediawiki< 1:1.19.8+dfsg-1
Mediawiki1 product
- mediawiki≥ 1.19.0, < 1.19.8 | ≥ 1.20.0, < 1.20.7 | ≥ 1.21.0, < 1.21.2
Ubuntu1 product
- mediawiki< 1:1.19.8+dfsg-1
Wikimedia foundation1 product
- mediawiki1.19.x before 1.19.8 | 1.20.x before 1.20.7 | and 1.21.x before 1.21.2
4 vendors · 4 products
References
10 links- lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlX Refsource MISCMailing ListPatchVendor Advisory
- bugzilla.wikimedia.org/show_bug.cgi?id=52746X Refsource MISCExploitIssue TrackingPatchVendor AdvisoryREPORT
