CVE-2013-4572
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before...
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
CVE-2013-4572- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List No score
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
CVE-2013-4572- Updated
- 2026-11-02
EUVDEUVD-2013-4430 No score
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
EUVD-2013-4430- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xg89-j94m-h233 No score
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before...
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
GHSA-xg89-j94m-h233- Updated
- 2026-11-02
OSV
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
CVE-2013-4572- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4572
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
DEBIAN-CVE-2013-4572- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4572
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
- Record
UBUNTU-CVE-2013-4572- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2013-0368 No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
Kevin Israel (Wikipedia user PleaseStand) identified and reported two vectors for injecting Javascript in CSS that bypassed MediaWiki's blacklist (CVE-2013-4567, CVE-2013-4568).
Internal review while debugging a site issue discovered that MediaWiki and the CentralNotice extension were incorrectly setting cache headers when a user was autocreated, causing the user's session cookies to be cached, and returned to other users (CVE-2013-4572).
- Record
MGASA-2013-0368- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:13 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:14 |
before 1:1.19.8+dfsg-2.2 | 1:1.19.8+dfsg-2.2 |
mediawikiDebian:7 From an advisory covering 11 CVEs |
before 1:1.19.14+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 11 moreShow less1:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.14+dfsg-0+deb7u1 |
mediawiki-extensionsDebian:7 From an advisory covering 11 CVEs |
before 3.5~deb7u1, plus listed versions 2.113.03.13.23.3 Show 4 moreShow less3.43~exp13~exp23~exp3 |
3.5~deb7u1 |
mediawikiMageia:3 From an advisory covering 3 CVEs |
before 1.20.8-1.mga3 | 1.20.8-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4572 is a high vulnerability (CVSS 7.5) in Mediawiki, published December 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. Fixed in mediawiki 1:1.19.8+dfsg-2.2.
References
bugzilla.wikimedia.org/show_bug.cgi?id=53032
lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
nvd.nist.gov/vuln/detail/CVE-2013-4572
github.com/advisories/GHSA-xg89-j94m-h233