Description
Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.
References
- [oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8 mailing-list
- 96906 vdb-entry
- [MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8 mailing-list
- mediawiki-cve20134308-xss(86891) vdb-entry
- 62218 vdb-entry
- https://bugzilla.wikimedia.org/show_bug.cgi?id=53320