Back to Database
Status published
Medium
CVE-2013-6455
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4,...
Vulnerability Description
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-6455
Credits & Attribution
No credits recorded in the NVD database.
More from Wikimedia Foundation
View All →CVE-2025-7363
TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser function
Unknown
0
CVE-2025-7362
MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message
Unknown
0
CVE-2025-7057
Stored XSS in Quiz
Unknown
0
CVE-2025-7056
Stored XSS in UrlShortener
Unknown
0
CVE-2025-6927
Autoblocks from global account suppressions are publicly visible
Low
2.3
Affected Vendor
Wikimedia Foundation
View all reports →Affected Software
MediaWiki
Vulnerable Versions:
before 1.19.10, 1.2x before 1.21.4, 1.22.x before 1.22.1
Timeline
Official Publish:
January 28th, 2020
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.