CVE-2013-2032
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password...
CVE-2013-2032 is a medium vulnerability (CVSS 5.0) in Mediawiki, published November 15, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in mediawiki 1:1.19.6-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.51%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:1.19.6-1mediawiki +4 more
Description
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 | before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:13 | before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:14 | before 1:1.19.6-1 | 1:1.19.6-1 |
mediawikiDebian:7 From an advisory covering 11 CVEs | before 1:1.19.14+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 11 moreShow less1:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 | 1:1.19.14+dfsg-0+deb7u1 |
mediawiki-extensionsDebian:7 From an advisory covering 11 CVEs | before 3.5~deb7u1, plus listed versions 2.113.03.13.23.3 Show 4 moreShow less3.43~exp13~exp23~exp3 | 3.5~deb7u1 |
What each source reports
NVD Score used
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- Updated
- 2026-11-02
EUVDEUVD-2013-2018No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
EUVD-2013-2018- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jw49-q332-x9hhNo score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password...
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
GHSA-jw49-q332-x9hh- Updated
- 2026-11-02
OSVNo score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
CVE-2013-2032- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2032No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
DEBIAN-CVE-2013-2032- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2032No score
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
- Record
UBUNTU-CVE-2013-2032- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html
secunia.com/advisories/55433
security.gentoo.org/glsa/glsa-201310-21.xml
lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000129.html