CVE

Id
64249  
CVE No.
CVE-2013-4302  
Status
Candidate  
Description
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
633802 64249 CVE-2013-4302 MLIST:[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
633803 64249 CVE-2013-4302 URL:http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html  View
633804 64249 CVE-2013-4302 MLIST:[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
633805 64249 CVE-2013-4302 URL:http://seclists.org/oss-sec/2013/q3/553  View
633806 64249 CVE-2013-4302 CONFIRM:https://bugzilla.wikimedia.org/show_bug.cgi?id=49090  View
633807 64249 CVE-2013-4302 CONFIRM:https://www.mediawiki.org/wiki/Release_notes/1.19  View
633808 64249 CVE-2013-4302 CONFIRM:https://www.mediawiki.org/wiki/Release_notes/1.20  View
633809 64249 CVE-2013-4302 CONFIRM:https://www.mediawiki.org/wiki/Release_notes/1.21  View
633810 64249 CVE-2013-4302 DEBIAN:DSA-2753  View
633811 64249 CVE-2013-4302 URL:http://www.debian.org/security/2013/dsa-2753  View
633812 64249 CVE-2013-4302 OSVDB:96912  View
633813 64249 CVE-2013-4302 URL:http://osvdb.org/96912  View
633814 64249 CVE-2013-4302 SECUNIA:54715  View
633815 64249 CVE-2013-4302 URL:http://secunia.com/advisories/54715  View
633816 64249 CVE-2013-4302 XF:mediawiki-cve20134302-info-disclosure(86896)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
22521 JVNDB-2013-004096 MediaWiki 用 Wikibase 拡張機能におけるクロスサイトスクリプティングの脆弱性 MediaWiki 用 Wikibase 拡張機能の repo/includes/EntityView.php には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2013-4307 64249 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004096.html  View