Vulnerability Name:

CVE-2013-4301

Assigned:2013-06-12
Published:2013-10-26
Updated:2017-08-28
Summary:includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
References:Source: MLIST
Type: UNKNOWN
[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8

Source: MLIST
Type: UNKNOWN
[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8

Source: CONFIRM
Type: PATCH
https://bugzilla.wikimedia.org/show_bug.cgi?id=46332

Source: XF
Type: UNKNOWN
mediawiki-cve20134301-info-disclosure(86895)

Source: CONFIRM
Type: UNKNOWN
https://www.mediawiki.org/wiki/Release_notes/1.19

Source: CONFIRM
Type: UNKNOWN
https://www.mediawiki.org/wiki/Release_notes/1.20

Source: CONFIRM
Type: UNKNOWN
https://www.mediawiki.org/wiki/Release_notes/1.21

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mediawiki:mediawiki:1.21:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.2:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.3:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.4:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.5:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.20.6:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.precise:def:20134301000
    V
    CVE-2013-4301 on Ubuntu 12.04 LTS (precise) - low.
    2013-10-26
    BACK
    mediawiki mediawiki 1.21
    mediawiki mediawiki 1.21.1
    mediawiki mediawiki 1.20
    mediawiki mediawiki 1.20.1
    mediawiki mediawiki 1.20.2
    mediawiki mediawiki 1.20.3
    mediawiki mediawiki 1.20.4
    mediawiki mediawiki 1.20.5
    mediawiki mediawiki 1.20.6
    mediawiki mediawiki 1.19.0
    mediawiki mediawiki 1.19.1
    mediawiki mediawiki 1.19.2
    mediawiki mediawiki 1.19.3
    mediawiki mediawiki 1.19.4
    mediawiki mediawiki 1.19.5
    mediawiki mediawiki 1.19.6
    mediawiki mediawiki 1.19.7