CVE-2013-4301
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x...
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
Exploit likelihood
What each source reports
NVD Score used
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
CVE-2013-4301- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
CVE-2013-4301- Updated
- 2026-11-02
EUVDEUVD-2013-4195 No score
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
EUVD-2013-4195- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6762-rqcg-h338 No score
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x...
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
GHSA-6762-rqcg-h338- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
CVE-2013-4301- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4301 No score
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
- Record
DEBIAN-CVE-2013-4301- Updated
- 2026-11-02
OSVMGASA-2013-0276 No score
Updated mediawiki package fixes security vulnerabilities
Full path disclosure in MediaWiki before 1.20.7, when an invalid language is specified in ResourceLoader (CVE-2013-4301).
Several API modules in MediaWiki before 1.20.7 allowed anti-CSRF tokens to be accessed via JSONP (CVE-2013-4302).
An issue with the MediaWiki API in MediaWiki before 1.20.7 where an invalid property name could be used for XSS with older versions of Internet Explorer (CVE-2013-4303).
- Record
MGASA-2013-0276- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiDebian:13 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiDebian:14 |
before 1:1.19.8+dfsg-1 | 1:1.19.8+dfsg-1 |
mediawikiMageia:2 From an advisory covering 3 CVEs |
before 1.20.7-1.mga2 | 1.20.7-1.mga2 |
mediawikiMageia:3 From an advisory covering 3 CVEs |
before 1.20.7-1.mga3 | 1.20.7-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4301 is a medium vulnerability (CVSS 5.0) in Mediawiki, published September 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in mediawiki 1:1.19.8+dfsg-1.
References
exchange.xforce.ibmcloud.com/vulnerabilities/86895
seclists.org/oss-sec/2013/q3/553
secunia.com/advisories/54715
lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html
osvdb.org/96913
bugzilla.wikimedia.org/show_bug.cgi?id=46332
Show 8 moreShow less
mediawiki.org/wiki/Release_notes/1.19
nvd.nist.gov/vuln/detail/CVE-2013-4301
github.com/advisories/GHSA-6762-rqcg-h338
security-tracker.debian.org/tracker/CVE-2013-4301
advisories.mageia.org/MGASA-2013-0276.html
bugs.mageia.org/show_bug.cgi?id=11157