CVE-2013-4301
published 2013-10-27CVE-2013-4301: includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to…
PriorityP419medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.08%
79.6th percentile
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mediawiki | < mediawiki 1:1.19.8+dfsg-1 (bookworm) | mediawiki 1:1.19.8+dfsg-1 (bookworm) |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | — | — |
| mediawiki | mediawiki | >= 0 < 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
| mediawiki | mediawiki | >= 0 < 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
| mediawiki | mediawiki | >= 0 < 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
| mediawiki | mediawiki | >= 0 < 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2013-4301: mediawiki - includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.1...
vendor_debian·2013·CVSS 5.0
CVE-2013-4301 [MEDIUM] CVE-2013-4301: mediawiki - includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.1...
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
Scope: local
bookworm: resolved (fixed in 1:1.19.8+dfsg-1)
bullseye: resolved (fixed in 1:1.19.8+dfsg-1)
forky: resolved (fixed in 1:1.19.8+dfsg-1)
sid: resolved (fixed in 1:1.19.8+dfsg-1)
trixie: resolved (fixed in 1:1.19.8+dfsg-1)
GHSA
GHSA-6762-rqcg-h338: includes/resourceloader/ResourceLoaderContext
ghsa_unreviewed·2022-05-17
CVE-2013-4301 [MEDIUM] CWE-200 GHSA-6762-rqcg-h338: includes/resourceloader/ResourceLoaderContext
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
OSV
CVE-2013-4301: includes/resourceloader/ResourceLoaderContext
osv·2013-10-27·CVSS 5.0
CVE-2013-4301 [MEDIUM] CVE-2013-4301: includes/resourceloader/ResourceLoaderContext
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
No detection rules found.
No public exploits indexed.
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlhttp://osvdb.org/96913http://seclists.org/oss-sec/2013/q3/553http://secunia.com/advisories/54715https://bugzilla.wikimedia.org/show_bug.cgi?id=46332https://exchange.xforce.ibmcloud.com/vulnerabilities/86895https://www.mediawiki.org/wiki/Release_notes/1.19https://www.mediawiki.org/wiki/Release_notes/1.20https://www.mediawiki.org/wiki/Release_notes/1.21http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlhttp://osvdb.org/96913http://seclists.org/oss-sec/2013/q3/553http://secunia.com/advisories/54715https://bugzilla.wikimedia.org/show_bug.cgi?id=46332https://exchange.xforce.ibmcloud.com/vulnerabilities/86895https://www.mediawiki.org/wiki/Release_notes/1.19https://www.mediawiki.org/wiki/Release_notes/1.20https://www.mediawiki.org/wiki/Release_notes/1.21
2013-10-27
Published