CVE-2013-4302
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5)...
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
Exploit likelihood
What each source reports
NVD Score used
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
CVE-2013-4302- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
CVE-2013-4302- Updated
- 2026-11-02
EUVDEUVD-2013-4196 No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
EUVD-2013-4196- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m76g-jmxw-8v24 No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5)...
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
GHSA-m76g-jmxw-8v24- Updated
- 2026-11-02
OSV No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
CVE-2013-4302- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4302 No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
DEBIAN-CVE-2013-4302- Updated
- 2026-11-02
OSVMGASA-2013-0276 No score
Updated mediawiki package fixes security vulnerabilities
Full path disclosure in MediaWiki before 1.20.7, when an invalid language is specified in ResourceLoader (CVE-2013-4301).
Several API modules in MediaWiki before 1.20.7 allowed anti-CSRF tokens to be accessed via JSONP (CVE-2013-4302).
An issue with the MediaWiki API in MediaWiki before 1.20.7 where an invalid property name could be used for XSS with older versions of Internet Explorer (CVE-2013-4303).
- Record
MGASA-2013-0276- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4302 No score
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.
- Record
UBUNTU-CVE-2013-4302- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiDebian:13 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiDebian:14 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiDebian:6.0 |
before 1:1.15.5-2squeeze6, plus listed versions 1:1.15.5-21:1.15.5-2squeeze11:1.15.5-2squeeze21:1.15.5-2squeeze31:1.15.5-2squeeze41:1.15.5-2squeeze5 |
1:1.15.5-2squeeze6 |
mediawikiDebian:7 |
before 1:1.19.5-1+deb7u1, plus listed versions 1:1.19.5-1 |
1:1.19.5-1+deb7u1 |
mediawikiMageia:2 From an advisory covering 3 CVEs |
before 1.20.7-1.mga2 | 1.20.7-1.mga2 |
mediawikiMageia:3 From an advisory covering 3 CVEs |
before 1.20.7-1.mga3 | 1.20.7-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4302 is a medium vulnerability (CVSS 5.0) in Mediawiki, published September 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.99%, the 80th percentile. Fixed in mediawiki 1:1.19.8+dfsg-1.
References
seclists.org/oss-sec/2013/q3/553
exchange.xforce.ibmcloud.com/vulnerabilities/86896
debian.org/security/2013/dsa-2753
secunia.com/advisories/54715
lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
osvdb.org/96912
Show 11 moreShow less
mediawiki.org/wiki/Release_notes/1.19
bugzilla.wikimedia.org/show_bug.cgi?id=49090
nvd.nist.gov/vuln/detail/CVE-2013-4302
github.com/advisories/GHSA-m76g-jmxw-8v24
security-tracker.debian.org/tracker/CVE-2013-4302
advisories.mageia.org/MGASA-2013-0276.html
bugs.mageia.org/show_bug.cgi?id=11157
ubuntu.com/security/CVE-2013-4302
cve.org/CVERecord?id=CVE-2013-4302