CVE-2013-2032

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.htmlThird Party Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.htmlPatch
http://secunia.com/advisories/55433
http://security.gentoo.org/glsa/glsa-201310-21.xmlThird Party Advisory
https://bugzilla.wikimedia.org/show_bug.cgi?id=46590Issue Tracking, Patch
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.htmlThird Party Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.htmlPatch
http://secunia.com/advisories/55433
http://security.gentoo.org/glsa/glsa-201310-21.xmlThird Party Advisory
https://bugzilla.wikimedia.org/show_bug.cgi?id=46590Issue Tracking, Patch

Timeline

Published: Nov 18, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20332.1Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x b CVE-2013-20346.8Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.CVE-2013-20354.4Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library pat CVE-2013-20364.3Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbit CVE-2013-20372.6httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the CVE-2013-20384.3The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitr CVE-2013-20394.0Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenti CVE-2013-20403.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20413.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web CVE-2013-20423.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20434.0apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allo CVE-2013-20445.8Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary we