CVE-2013-4301 Information disclosure in n/a

Q: Is CVE-2013-4301 being exploited?

There is no known exploitation of CVE-2013-4301 in the wild and no public exploit code.

Medium 5.0 Published 27 Oct 2013 Updated 6 Aug 2024

Remote attackers can obtain sensitive installation path information by sending a specific character in the language parameter to the resource loader.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-4301?

CVE-2013-4301 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 27 Oct 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.

Weakness: CWE-200

Which versions are affected by CVE-2013-4301?

It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2013-4301?

Upgrade to a fixed version.

Is CVE-2013-4301 being exploited?

There is no known exploitation of CVE-2013-4301 in the wild and no public exploit code.

All Mediawiki Mediawiki vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-4301, GHSA-6762-rqcg-h338.