XSS in Mediawiki

CVE-2013-6452

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.010 (59.5th percentile) — read the EPSS interpretation.

Affected products

  • Mediawiki — versions 1.22.0, 1.21, 1.21.1
  • N/a — versions n/a

Weakness classification (CWE)

References