CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
80.1%
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Vendor | Product | Version | CPE |
---|---|---|---|
mediawiki | mediawiki | 1.11 | cpe:/a:mediawiki:mediawiki:1.11::: |
mediawiki | mediawiki | 1.13.1 | cpe:/a:mediawiki:mediawiki:1.13.1::: |
mediawiki | mediawiki | 1.17.4 | cpe:/a:mediawiki:mediawiki:1.17.4::: |
mediawiki | mediawiki | 1.17 | cpe:/a:mediawiki:mediawiki:1.17:beta_1:: |
mediawiki | mediawiki | 1.12.1 | cpe:/a:mediawiki:mediawiki:1.12.1::: |
mediawiki | mediawiki | 1.19.0 | cpe:/a:mediawiki:mediawiki:1.19.0::: |
mediawiki | mediawiki | 1.19.3 | cpe:/a:mediawiki:mediawiki:1.19.3::: |
mediawiki | mediawiki | 1.12.3 | cpe:/a:mediawiki:mediawiki:1.12.3::: |
mediawiki | mediawiki | 1.10.3 | cpe:/a:mediawiki:mediawiki:1.10.3::: |
mediawiki | mediawiki | 1.14.0 | cpe:/a:mediawiki:mediawiki:1.14.0:rc1:: |
lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html
lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html
secunia.com/advisories/55433
security.gentoo.org/glsa/glsa-201310-21.xml
bugzilla.wikimedia.org/show_bug.cgi?id=46590