{"api_version":"1","generated_at":"2026-07-23T08:42:15+00:00","cve":"CVE-2013-4303","urls":{"html":"https://cve.report/CVE-2013-4303","api":"https://cve.report/api/cve/CVE-2013-4303.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-4303","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4303"},"summary":{"title":"CVE-2013-4303","description":"includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of \".\" (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2019-12-11 19:15:00","updated_at":"2019-12-19 17:37:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html","name":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html","refsource":"MISC","tags":["Mailing List","Patch","Vendor Advisory"],"title":"[MediaWiki-announce] MediaWiki Security Release: 1.21.2,\t1.20.7 and 1.19.8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86897","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86897","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/oss-sec/2013/q3/553","name":"http://seclists.org/oss-sec/2013/q3/553","refsource":"MISC","tags":["Mailing List","Third Party Advisory"],"title":"oss-sec: Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/62194","name":"http://www.securityfocus.com/bid/62194","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"],"title":"Mediawiki CVE-2013-4303 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=52746","name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=52746","refsource":"MISC","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"],"title":"⚓ T54746 XSS in MediaWiki API (through invalid property name) reintroduced in 1.21.1","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4303","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4303","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"4303","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4303","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2013-4303","STATE":"PUBLIC"},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of \".\" (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Scripting"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Wikimedia Foundation","product":{"product_data":[{"product_name":"MediaWiki","version":{"version_data":[{"version_value":"1.19.x before 1.19.8"},{"version_value":"1.20.x before 1.20.7"},{"version_value":"and 1.21.x before 1.21.2"}]}}]}}]}},"references":{"reference_data":[{"refsource":"MISC","name":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html","url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html"},{"refsource":"MISC","name":"http://seclists.org/oss-sec/2013/q3/553","url":"http://seclists.org/oss-sec/2013/q3/553"},{"refsource":"MISC","name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=52746","url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=52746"},{"refsource":"MISC","name":"http://www.securityfocus.com/bid/62194","url":"http://www.securityfocus.com/bid/62194"},{"refsource":"MISC","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86897","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86897"}]}},"nvd":{"publishedDate":"2019-12-11 19:15:00","lastModifiedDate":"2019-12-19 17:37:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.19.0","versionEndExcluding":"1.19.8","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.20.0","versionEndExcluding":"1.20.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.21.0","versionEndExcluding":"1.21.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"4303","Ordinal":"63962","Title":"CVE-2013-4303","CVE":"CVE-2013-4303","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"4303","Ordinal":"1","NoteData":"includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of \".\" (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.","Type":"Description","Title":null},{"CveYear":"2013","CveId":"4303","Ordinal":"2","NoteData":"2019-12-11","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"4303","Ordinal":"3","NoteData":"2019-12-11","Type":"Other","Title":"Modified"}]}}}