CVE-2013-4572
Fixed in a distro release EPSS 2%
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
Products: Wikimedia Foundation MediaWiki
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | mediawiki | 1:1.19.8+dfsg-2.2 |
| Debian:13 | mediawiki | 1:1.19.8+dfsg-2.2 |
| Debian:14 | mediawiki | 1:1.19.8+dfsg-2.2 |
| Debian:7 | mediawiki | 1:1.19.14+dfsg-0+deb7u1 |
| Debian:7 | mediawiki-extensions | 3.5~deb7u1 |
| Ubuntu:14.04:LTS | mediawiki | 1:1.19.11+dfsg-1 |