VulnerabilityModified

CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension…

MEDIUM 5.0EPSS 2.51%

Does this matter?

Lower severity and a low EPSS score (2.51%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS: 2.51% probability · 84th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: mediawiki/mediawiki · fedoraproject/fedora · gentoo/linux
Source: secalert@redhat.com

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.htmlThird Party Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.htmlPatch
http://secunia.com/advisories/55433
http://security.gentoo.org/glsa/glsa-201310-21.xmlThird Party Advisory
https://bugzilla.wikimedia.org/show_bug.cgi?id=46590Issue Tracking, Patch
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.htmlThird Party Advisory
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.htmlPatch
http://secunia.com/advisories/55433
http://security.gentoo.org/glsa/glsa-201310-21.xmlThird Party Advisory
https://bugzilla.wikimedia.org/show_bug.cgi?id=46590Issue Tracking, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.