CVE-2013-4308

Description

Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/86891

https://bugzilla.wikimedia.org/show_bug.cgi?id=53320

http://www.securityfocus.com/bid/62218

http://seclists.org/oss-sec/2013/q3/553

http://osvdb.org/96906

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3