Mediawiki CVE-2013-4301 Full Path Information Disclosure Vulnerability

Bugtraq ID:	62434
Class:	Unknown
CVE:	CVE-2013-4301
Remote:	Yes
Local:	No
Published:	Sep 04 2013 12:00AM
Updated:	Apr 13 2015 09:24PM
Credit:	Mark A. Hershberger
Vulnerable:	MediaWiki Mediawiki 1.21.1 MediaWiki Mediawiki 1.20.6 MediaWiki Mediawiki 1.20.5 MediaWiki Mediawiki 1.20.4 MediaWiki Mediawiki 1.20.3 MediaWiki Mediawiki 1.20.2 MediaWiki Mediawiki 1.20.1 MediaWiki Mediawiki 1.19.7 MediaWiki Mediawiki 1.19.6 MediaWiki Mediawiki 1.19.5 MediaWiki Mediawiki 1.19.4 MediaWiki Mediawiki 1.19.3 MediaWiki Mediawiki 1.19.2 MediaWiki Mediawiki 1.19.1 MediaWiki Mediawiki 1.20 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux
Not Vulnerable:	MediaWiki Mediawiki 1.21.2 MediaWiki Mediawiki 1.20.7 MediaWiki Mediawiki 1.19.8

Mediawiki CVE-2013-4301 Full Path Information Disclosure Vulnerability

Mediawiki is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Versions prior to Mediawiki 1.19.8, 1.20.7 and 1.21.2 are vulnerable.

Mediawiki CVE-2013-4301 Full Path Information Disclosure Vulnerability

Attackers can exploit this issue using a browser or readily available tools.

Mediawiki CVE-2013-4301 Full Path Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mediawiki CVE-2013-4301 Full Path Information Disclosure Vulnerability

References:

• Bug 46332 - using "<" in as a value in the lang query string throws exception (MediaWiki )
  
• CVE request: MediaWiki Security Release: 1.21.2, 1.20.7 and 1.19.8 (oss-sec)
  
• MediaWiki 1.19 Release notes (MediaWiki)
  
• MediaWiki 1.20 Release notes (MediaWiki )
  
• MediaWiki 1.21 Release notes (MediaWiki)
  
• MediaWiki Homepage (MediaWiki)