CVE-2013-2032
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password...
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Exploit likelihood
What each source reports
NVD Score used
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- Updated
- 2026-11-02
EUVDEUVD-2013-2018 No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
EUVD-2013-2018- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jw49-q332-x9hh No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password...
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
GHSA-jw49-q332-x9hh- Updated
- 2026-11-02
OSV No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2032 No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
DEBIAN-CVE-2013-2032- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2032 No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
UBUNTU-CVE-2013-2032- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:13 |
before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:14 |
before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:7 From an advisory covering 11 CVEs |
before 1:1.19.14+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 11 moreShow less1:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.14+dfsg-0+deb7u1 |
mediawiki-extensionsDebian:7 From an advisory covering 11 CVEs |
before 3.5~deb7u1, plus listed versions 2.113.03.13.23.3 Show 4 moreShow less3.43~exp13~exp23~exp3 |
3.5~deb7u1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2032 is a medium vulnerability (CVSS 5.0) in Mediawiki, published November 15, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in mediawiki 1:1.19.6-1.
References
lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html
secunia.com/advisories/55433
security.gentoo.org/glsa/glsa-201310-21.xml
lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html