Description
Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.13.2-1 | — |
| Debian 13 | mediawiki | 1:1.13.2-1 | — |
| Debian 12 | mediawiki | 1:1.13.2-1 | — |
| Debian 5.0 | mediawiki | 1.12.0-2lenny1 | DTSA-171-1 |
Advisories 1
- DTSA-171-1 mediawiki - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- mediawiki-useskin-xss(45632) vdb-entry
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_2/phase3/RELEASE-NOTES
- [oss-security] 20081002 CVE request: XSS in mediawiki 1.13.1 and 1.12.0 mailing-list
- 31540 vdb-entry
- 32128 third-party-advisory
- FEDORA-2008-8678 vendor-advisory
- ADV-2008-2737 vdb-entry
- FEDORA-2008-8639 vendor-advisory
- 32131 third-party-advisory
- [MediaWiki-announce] 20081002 MediaWiki 1.13.2, 1.12.1 security update mailing-list
- http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_1/phase3/RELEASE-NOTES