NVD

Id
39930  
Name
CVE-2013-4304  
Description
The CentralAuth extension for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 caches a valid CentralAuthUser object in the centralauth_User cookie even when a user has not successfully logged in, which allows remote attackers to bypass authentication without a password.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-01-26  
Modified Date
2014-01-27  
Seq
2013-4304  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
203131 39930 CVE-2013-4304 [MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
203132 39930 CVE-2013-4304 [oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8  View
203133 39930 CVE-2013-4304 mediawiki-cve20134304-security-bypass(86894)  View
203134 39930 CVE-2013-4304 https://bugzilla.wikimedia.org/show_bug.cgi?id=52338  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24356 JVNDB-2013-005931 MediaWiki 用 CentralAuth 拡張機能におけるパスワードなしで認証を回避される脆弱性 MediaWiki 用 CentralAuth 拡張機能は、ユーザがログインに成功しなかった場合にも、centralauth_User Cookie 内の有効な CentralAuthUser オブジェクトをキャッシュするため、パスワードなしで認証を回避される脆弱性が存在します。 CVE-2013-4304 64246 CVE-2013-4304 39930 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005931.html 2013-09-03 2014-01-28 View