PT-2014-3123

CVE-2013-6453

Published

2014-02-07

Updated

2014-05-13

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.10 MediaWiki versions 1.20.x through 1.21.3 MediaWiki versions 1.22.x prior to 1.22.1

Description The issue is related to the improper sanitization of SVG files, which can be exploited by remote attackers via invalid XML, potentially leading to unspecified impact.

Recommendations For MediaWiki versions prior to 1.19.10, update to version 1.19.10 or later. For MediaWiki versions 1.20.x through 1.21.3, update to version 1.21.4 or later. For MediaWiki versions 1.22.x prior to 1.22.1, update to version 1.22.1 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2013-6453

ALT-PU-2014-1172

DSA-2891-1