PT-2020-7550 · Mediawiki+1 · Mediawiki Centralauth Extension+1

Eran Roz · Published 2014-02-07 · Updated 2020-01-30 · CVE-2013-6455

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki CentralAuth extension versions prior to 1.19.10 MediaWiki CentralAuth extension versions 1.2x prior to 1.21.4 MediaWiki CentralAuth extension versions 1.22.x prior to 1.22.1

Description: The issue allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

Recommendations: For MediaWiki CentralAuth extension versions prior to 1.19.10, update to version 1.19.10 or later. For MediaWiki CentralAuth extension versions 1.2x prior to 1.21.4, update to version 1.21.4 or later. For MediaWiki CentralAuth extension versions 1.22.x prior to 1.22.1, update to version 1.22.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2014-1172

CVE-2013-6455

Affected Products

Alt Linux

Mediawiki Centralauth Extension

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-6455 · Security Note
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html · Vendor Advisory
• https://t.me/cvenotify/514 · Telegram Post