Vulnerability in Gentoo Linux

CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions o…

EPSS: 0.025 (83.0th percentile) — read the EPSS interpretation.

Affected products

Gentoo Linux
Mediawiki — versions 1.1.0, 1.10.0, 1.10.1
Fedoraproject Fedora — versions 17, 18, 19
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Issue Tracking)