Vulnerability Details CVE-2013-4306
Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 49.1%
CVSS Severity
CVSS v2 Score 6.8
References
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
- http://osvdb.org/96908
- http://seclists.org/oss-sec/2013/q3/553
- http://www.securityfocus.com/bid/62210
- https://bugzilla.wikimedia.org/show_bug.cgi?id=45019
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86893
- https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
- http://osvdb.org/96908
- http://seclists.org/oss-sec/2013/q3/553
- http://www.securityfocus.com/bid/62210
- https://bugzilla.wikimedia.org/show_bug.cgi?id=45019
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86893
- https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651
Products affected by CVE-2013-4306
-
cpe:2.3:a:mediawiki:mediawiki:1.19.0
-
cpe:2.3:a:mediawiki:mediawiki:1.19.1
-
cpe:2.3:a:mediawiki:mediawiki:1.19.2
-
cpe:2.3:a:mediawiki:mediawiki:1.19.3
-
cpe:2.3:a:mediawiki:mediawiki:1.19.4
-
cpe:2.3:a:mediawiki:mediawiki:1.19.5
-
cpe:2.3:a:mediawiki:mediawiki:1.19.6
-
cpe:2.3:a:mediawiki:mediawiki:1.19.7
-
cpe:2.3:a:mediawiki:mediawiki:1.20.0
-
cpe:2.3:a:mediawiki:mediawiki:1.20.1
-
cpe:2.3:a:mediawiki:mediawiki:1.20.2
-
cpe:2.3:a:mediawiki:mediawiki:1.20.3
-
cpe:2.3:a:mediawiki:mediawiki:1.20.4
-
cpe:2.3:a:mediawiki:mediawiki:1.20.5
-
cpe:2.3:a:mediawiki:mediawiki:1.20.6
-
cpe:2.3:a:mediawiki:mediawiki:1.21.0
-
cpe:2.3:a:mediawiki:mediawiki:1.21.1