PRIOn knowledge basePRION:CVE-2013-2032Design/Logic Flaw
7.3 High
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
79.5%
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| fedora | eq | 17 | |
| fedora | eq | 18 | |
| fedora | eq | 19 | |
| mediawiki | eq | 1.16.0 beta2 | |
| mediawiki | eq | 1.19 | |
| mediawiki | eq | 1.19 beta-1 | |
| mediawiki | eq | 1.12.1 | |
| mediawiki | eq | 1.17.1 | |
| mediawiki | eq | 1.13.0 rc2 | |
| mediawiki | eq | 1.14.0 rc1 |
References
secunia.com/advisories/55433
security.gentoo.org/glsa/glsa-201310-21.xml
bugzilla.wikimedia.org/show_bug.cgi?id=46590
lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html
lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html
lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html
Related
7.3 High
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.007 Low
EPSS
Percentile
79.5%