{"api_version":"1","generated_at":"2026-07-23T06:57:33+00:00","cve":"CVE-2013-4306","urls":{"html":"https://cve.report/CVE-2013-4306","api":"https://cve.report/api/cve/CVE-2013-4306.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-4306","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4306"},"summary":{"title":"CVE-2013-4306","description":"Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that \"perform sensitive write actions\" via unspecified vectors.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-10-11 21:55:44","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html","name":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"[MediaWiki-announce] MediaWiki Security Release: 1.21.2,\t1.20.7 and 1.19.8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/96908","name":"http://osvdb.org/96908","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651","name":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"rECHU99ad25d066ce","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/oss-sec/2013/q3/553","name":"http://seclists.org/oss-sec/2013/q3/553","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"oss-sec: Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019","name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"⚓ T47019 Checkuser API does not use tokens","mime":"text/html","httpstatus":"200","archivestatus":"403"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86893","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86893","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/62210","name":"http://www.securityfocus.com/bid/62210","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"MediaWiki CheckUser Extension CVE-2013-4306 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4306","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4306","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"4306","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T16:38:01.961Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://seclists.org/oss-sec/2013/q3/553"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651"},{"name":"[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html"},{"name":"62210","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/62210"},{"name":"96908","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/96908"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019"},{"name":"mediawiki-cve20134306-csrf(86893)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86893"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-09-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that \"perform sensitive write actions\" via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","tags":["mailing-list","x_refsource_MLIST"],"url":"http://seclists.org/oss-sec/2013/q3/553"},{"tags":["x_refsource_CONFIRM"],"url":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651"},{"name":"[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","tags":["mailing-list","x_refsource_MLIST"],"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html"},{"name":"62210","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/62210"},{"name":"96908","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/96908"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019"},{"name":"mediawiki-cve20134306-csrf(86893)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86893"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2013-4306","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that \"perform sensitive write actions\" via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[oss-security] 20130904 Re: CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","refsource":"MLIST","url":"http://seclists.org/oss-sec/2013/q3/553"},{"name":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651","refsource":"CONFIRM","url":"https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651"},{"name":"[MediaWiki-announce] 20130903 MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8","refsource":"MLIST","url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html"},{"name":"62210","refsource":"BID","url":"http://www.securityfocus.com/bid/62210"},{"name":"96908","refsource":"OSVDB","url":"http://osvdb.org/96908"},{"name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019","refsource":"CONFIRM","url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=45019"},{"name":"mediawiki-cve20134306-csrf(86893)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/86893"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-4306","datePublished":"2013-10-11T21:00:00.000Z","dateReserved":"2013-06-12T00:00:00.000Z","dateUpdated":"2024-08-06T16:38:01.961Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-10-11 21:55:44","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.19.0","versionEndExcluding":"1.19.8","matchCriteriaId":"079904A7-7992-48C6-9C50-54892F24826C"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.20.0","versionEndExcluding":"1.20.7","matchCriteriaId":"B32E340B-5FF7-43F7-A1E8-16CACE765F31"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","versionStartIncluding":"1.21.0","versionEndExcluding":"1.21.2","matchCriteriaId":"967C4E11-A76A-4519-950D-D580C31AFB2C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"4306","Ordinal":"1","Title":"CVE-2013-4306","CVE":"CVE-2013-4306","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"4306","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that \"perform sensitive write actions\" via unspecified vectors.","Type":"Description","Title":"CVE-2013-4306"},{"CveYear":"2013","CveId":"4306","Ordinal":"2","NoteData":"2013-10-11","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"4306","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}