6.8

CVE-2013-4306

Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mediawiki ≫ Mediawiki Version >= 1.19.0 < 1.19.8
Mediawiki ≫ Mediawiki Version >= 1.20.0 < 1.20.7
Mediawiki ≫ Mediawiki Version >= 1.21.0 < 1.21.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.9% 0.549
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
Patch
http://seclists.org/oss-sec/2013/q3/553
Third Party Advisory
Mailing List
http://osvdb.org/96908
Broken Link
http://www.securityfocus.com/bid/62210
Third Party Advisory
VDB Entry
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019
Patch
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893
VDB Entry
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651
Patch