CVE-2013-4306

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlPatch
http://osvdb.org/96908Broken Link
http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/62210Third Party Advisory, VDB Entry
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019Issue Tracking, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893VDB Entry
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651Patch
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlPatch
http://osvdb.org/96908Broken Link
http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/62210Third Party Advisory, VDB Entry
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019Issue Tracking, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893VDB Entry
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651Patch

Timeline

Published: Oct 11, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43074.3Multiple cross-site scripting (XSS) vulnerabilities in repo/includes/EntityView.php in the Wikibase extension for MediaWiki 1.19.x before 1.CVE-2013-43084.3Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for Medi CVE-2013-43105.8Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix.CVE-2013-43114.6libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrict CVE-2013-43126.2The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by send CVE-2013-43137.5Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strin CVE-2013-43144.3The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name fiel CVE-2013-43155.0Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to r CVE-2013-431610.0Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.CVE-2013-43174.3In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the us CVE-2013-43185.4File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.CVE-2013-43199.0pbs_mom in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x, 4.x, and earlier does not properly restrict