CVE-2013-4301

Published: Oct 27, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.

Affected (17)

Products: Mediawiki: Mediawiki

1 product

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Version 1.19.0
Mediawiki Mediawiki	Version 1.19.1
Mediawiki Mediawiki	Version 1.19.2
Mediawiki Mediawiki	Version 1.19.3
Mediawiki Mediawiki	Version 1.19.4
Mediawiki Mediawiki	Version 1.19.5
Mediawiki Mediawiki	Version 1.19.6
Mediawiki Mediawiki	Version 1.19.7
Mediawiki Mediawiki	Version 1.20.1
Mediawiki Mediawiki	Version 1.20.2
Mediawiki Mediawiki	Version 1.20.3
Mediawiki Mediawiki	Version 1.20.4
Mediawiki Mediawiki	Version 1.20.5
Mediawiki Mediawiki	Version 1.20.6
Mediawiki Mediawiki	Version 1.20
Mediawiki Mediawiki	Version 1.21.1
Mediawiki Mediawiki	Version 1.21

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (18)

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

Source: secalert@redhat.com

http://osvdb.org/96913

Source: secalert@redhat.com

http://seclists.org/oss-sec/2013/q3/553

Source: secalert@redhat.com

http://secunia.com/advisories/54715

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.wikimedia.org/show_bug.cgi?id=46332

Source: secalert@redhat.com

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/86895

Source: secalert@redhat.com

https://www.mediawiki.org/wiki/Release_notes/1.19

Source: secalert@redhat.com

https://www.mediawiki.org/wiki/Release_notes/1.20

Source: secalert@redhat.com

https://www.mediawiki.org/wiki/Release_notes/1.21

Source: secalert@redhat.com

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/96913

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/oss-sec/2013/q3/553

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/54715

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.wikimedia.org/show_bug.cgi?id=46332

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/86895

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mediawiki.org/wiki/Release_notes/1.19

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mediawiki.org/wiki/Release_notes/1.20

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mediawiki.org/wiki/Release_notes/1.21

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.