CVE-2013-4568

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-12-13 · updated 2026-06-16

Description

Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.

Affected products

Wikimedia Foundation MediaWiki: through 1.19.8; 1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5 (+16)

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
http://secunia.com/advisories/57472
http://www.debian.org/security/2014/dsa-2891
http://www.securityfocus.com/bid/63761
https://bugzilla.wikimedia.org/attachment.cgi?id=13452&action=diff
https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
http://secunia.com/advisories/57472

Get alerted when CVE-2013-4568 or the next vulnerability affects your stack