CVE-2013-4308

https://notcve.org/view.php?id=CVE-2013-4308

Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject. Vulnerabilidad cross-site scripting (XSS) en pages/TalkpageHistoryView.php en la extensión LiquidThreads (LQT) 2.x y posiblemente 3.x para MediaWiki 1.19.x (anteriores a 1.19.8) 1.20.x (anteriores a 1.20.7) y 1.21.x (anteriores a 1.21.2) permite a atacantes remotos inyectar script web o HTML a discrección a través de un Asunto de hilo. • http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html http://osvdb.org/96906 http://seclists.org/oss-sec/2013/q3/553 http://www.securityfocus.com/bid/62218 https://bugzilla.wikimedia.org/show_bug.cgi?id=53320 https://exchange.xforce.ibmcloud.com/vulnerabilities/86891 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •