Follow @discotekdotca
CVE-2013-2032
Current Description
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Basic Data
| Published | November 18, 2013 |
|---|---|
| Last Modified | October 18, 2016 |
| Assigner | cve@mitre.org |
| Data Type | CVE |
| Data Format | MITRE |
| Data Version | 4.0 |
| Problem Type | CWE-264 |
| CVE Data Version | 4.0 |
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|---|
| CVSS 2 - Vector String | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| CVSS 2 - Access Vector | NETWORK |
| CVSS 2 - Access Complexity | LOW |
| CVSS 2 - Authentication | NONE |
| CVSS 2 - Confidentiality Impact | NONE |
| CVSS 2 - Availability Impact | NONE |
| CVSS 2 - Base Score | 5.0 |
| Severity | MEDIUM |
| Exploitability Score | 10.0 |
| Impact Score | 2.9 |
| Obtain All Privilege | false |
| Obtain User Privilege | false |
| Obtain Other Privilege | false |
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 Application Mediawiki Mediawiki 1.1.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.0 rc2 * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.10.4 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.11 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.11.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.11.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.11.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.11.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.12.4 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.0 rc2 * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.13.4 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.14.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.14.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.14.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.4 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.15.5 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.0 beta1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.0 beta2 * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.0 beta3 * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.16.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17 beta_1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.17.4 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.18 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.18 beta_1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.18.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.18.0 rc1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.18.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.18.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.18.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19 beta_1 * * * * * * 2.3 Application Mediawiki Mediawiki 1.19 beta_2 * * * * * * 2.3 Application Mediawiki Mediawiki 1.19.0 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.19.4 * * * * * * * 2.3 Application Mediawiki Mediawiki * * * * * * * * 1.19.5 2.3 Application Mediawiki Mediawiki 1.20.1 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.20.2 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.20.3 * * * * * * * 2.3 Application Mediawiki Mediawiki 1.20.4 * * * * * * * -
OR - Configuration 2
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 OS Fedoraproject Fedora 17 * * * * * * * 2.3 OS Fedoraproject Fedora 18 * * * * * * * 2.3 OS Fedoraproject Fedora 19 * * * * * * * -
OR - Configuration 3
Cpe Version Part Vendor Product Version Update Edition Language SW Edition Target SW Target HW Other Version Start Including Version End Including Version Start Excluding Version End Excluding 2.3 OS Gentoo Linux * * * * * * * *
Vulnerable Software List
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | *, 1.1.0, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.11, 1.11.0, 1.11.1, 1.11.2, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4, 1.14.0, 1.14.1, 1.15.0, 1.15.1, 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.16.0, 1.16.1, 1.16.2, 1.17, 1.17.0, 1.17.1, 1.17.2, 1.17.3, 1.17.4, 1.18, 1.18.0, 1.18.1, 1.18.2, 1.18.3, 1.19, 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.20.1, 1.20.2, 1.20.3, 1.20.4 |
| Fedoraproject | Fedora | 17, 18, 19 |
| Gentoo | Linux | * |
References
| Name | Source | URL | Tags |
|---|---|---|---|
| FEDORA-2013-7701 | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html | FEDORA | Third Party Advisory |
| FEDORA-2013-7714 | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html | FEDORA | Third Party Advisory |
| FEDORA-2013-7654 | http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html | FEDORA | Third Party Advisory |
| [MediaWiki-announce] 20130430 MediaWiki Security Release: 1.20.5 and 1.19.6 | http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html | MLIST | Patch |
| 55433 | http://secunia.com/advisories/55433 | SECUNIA | |
| GLSA-201310-21 | http://security.gentoo.org/glsa/glsa-201310-21.xml | GENTOO | Third Party Advisory |
| https://bugzilla.wikimedia.org/show_bug.cgi?id=46590 | https://bugzilla.wikimedia.org/show_bug.cgi?id=46590 | CONFIRM | Issue Tracking Patch |