p PatchFirst

CVE-2013-4572

CVE-2013-4572

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

CVSS 7.5 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mediawiki

    Versions
    • before 1.19.9: Affected
    • 1.20.x before 1.20.8: Affected
    • 1.21.x before 1.21.3: Affected

    No fix published

  • mediawiki Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:1.19.8+dfsg-2.2

    Update to 1:1.19.8+dfsg-2.2

  • mediawiki Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:1.19.8+dfsg-2.2

    Update to 1:1.19.8+dfsg-2.2

  • mediawiki Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:1.19.8+dfsg-2.2

    Update to 1:1.19.8+dfsg-2.2

Original sources

Check your server →