CVE-2013-6455

Published: Jan 28, 2020Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

Affected (3)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Before 1.19.10
Mediawiki Mediawiki	From 1.20.0 to 1.21.4
Mediawiki Mediawiki	From 1.22.0 to 1.22.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.