Description

The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

Remediation

References

CVE-2013-6455

Related Vulnerabilities

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-0465)

Atlassian Confluence Unauthenticated Remote Code Execution Vulnerability (CVE-2022-26134)

phpBB Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1627)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-42119)

MySQL CVE-2019-2566 Vulnerability (CVE-2019-2566)

Severity

Medium

Classification

CVE-2013-6455 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities