CVE-2013-4306

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-4306
Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Patch
http://osvdb.org/96908 Broken Link
http://seclists.org/oss-sec/2013/q3/553 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/62210 Third Party Advisory VDB Entry
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 Issue Tracking Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893 VDB Entry
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 Patch
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html Patch
http://osvdb.org/96908 Broken Link
http://seclists.org/oss-sec/2013/q3/553 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/62210 Third Party Advisory VDB Entry
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 Issue Tracking Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893 VDB Entry
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
History

21 Nov 2024, 01:55

Type Values Removed Values Added
References () http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - Patch () http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html - Patch
References () http://osvdb.org/96908 - Broken Link () http://osvdb.org/96908 - Broken Link
References () http://seclists.org/oss-sec/2013/q3/553 - Mailing List, Third Party Advisory () http://seclists.org/oss-sec/2013/q3/553 - Mailing List, Third Party Advisory
References () http://www.securityfocus.com/bid/62210 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/62210 - Third Party Advisory, VDB Entry
References () https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 - Issue Tracking, Patch () https://bugzilla.wikimedia.org/show_bug.cgi?id=45019 - Issue Tracking, Patch
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/86893 - VDB Entry () https://exchange.xforce.ibmcloud.com/vulnerabilities/86893 - VDB Entry
References () https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 - Patch () https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651 - Patch
Information

Published : 2013-10-11 21:55

Updated : 2025-04-11 00:51

NVD link : CVE-2013-4306

Mitre link : CVE-2013-4306

CVE.ORG link : CVE-2013-4306

JSON object : View

Products Affected

mediawiki

  • mediawiki
CWE
CWE-352

Cross-Site Request Forgery (CSRF)