CVE-2013-4306

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-10-11 · updated 2026-06-16
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.

Affected products

Wikimedia Foundation MediaWiki: from 1.19.0 before 1.19.8; from 1.20.0 before 1.20.7; from 1.21.0 before 1.21.2 — fixed in 1.19.8, 1.20.7, 1.21.2

How to fix

Upgrade to a fixed version: Wikimedia Foundation MediaWiki 1.19.8, 1.20.7, 1.21.2. Check the vendor advisory for mitigations.

References

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
http://osvdb.org/96908
http://seclists.org/oss-sec/2013/q3/553
http://www.securityfocus.com/bid/62210
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019
https://exchange.xforce.ibmcloud.com/vulnerabilities/86893
https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
http://osvdb.org/96908
http://seclists.org/oss-sec/2013/q3/553
http://www.securityfocus.com/bid/62210
https://bugzilla.wikimedia.org/show_bug.cgi?id=45019

Get alerted when CVE-2013-4306 or the next vulnerability affects your stack