CVE

Id
64251  
CVE No.
CVE-2013-4304  
Status
Candidate  
Description
The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows remote attackers to bypass authentication without a password.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
633817 64251 CVE-2013-4304 MLIST:[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
633818 64251 CVE-2013-4304 URL:http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html  View
633819 64251 CVE-2013-4304 MLIST:[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
633820 64251 CVE-2013-4304 URL:http://seclists.org/oss-sec/2013/q3/553  View
633821 64251 CVE-2013-4304 CONFIRM:https://bugzilla.wikimedia.org/show_bug.cgi?id=52338  View
633822 64251 CVE-2013-4304 OSVDB:96910  View
633823 64251 CVE-2013-4304 URL:http://osvdb.org/96910  View
633824 64251 CVE-2013-4304 SECUNIA:54723  View
633825 64251 CVE-2013-4304 URL:http://secunia.com/advisories/54723  View
633826 64251 CVE-2013-4304 XF:mediawiki-cve20134304-security-bypass(86894)  View

Related JVN