medium5.0
CVE-2013-4302
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includ…
Impact
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | Versions 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.19.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
- http://osvdb.org/96912
- http://seclists.org/oss-sec/2013/q3/553
- http://secunia.com/advisories/54715
- http://www.debian.org/security/2013/dsa-2753
- https://bugzilla.wikimedia.org/show_bug.cgi?id=49090
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86896
- https://www.mediawiki.org/wiki/Release_notes/1.19
- https://www.mediawiki.org/wiki/Release_notes/1.20
- https://www.mediawiki.org/wiki/Release_notes/1.21
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
- http://osvdb.org/96912
- http://seclists.org/oss-sec/2013/q3/553
- http://secunia.com/advisories/54715
- http://www.debian.org/security/2013/dsa-2753
- https://bugzilla.wikimedia.org/show_bug.cgi?id=49090
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86896
- https://www.mediawiki.org/wiki/Release_notes/1.19
- https://www.mediawiki.org/wiki/Release_notes/1.20
- https://www.mediawiki.org/wiki/Release_notes/1.21