CVE-2013-4306

Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.

• CWE-352

• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlPatch
• http://osvdb.org/96908Broken Link
• http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62210Third Party Advisory, VDB Entry
• https://bugzilla.wikimedia.org/show_bug.cgi?id=45019Issue Tracking, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86893VDB Entry
• https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651Patch
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlPatch
• http://osvdb.org/96908Broken Link
• http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62210Third Party Advisory, VDB Entry
• https://bugzilla.wikimedia.org/show_bug.cgi?id=45019Issue Tracking, Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86893VDB Entry
• https://git.wikimedia.org/commit/mediawiki%2Fextensions%2FCheckUser.git/99ad25d066ce6111e798427cba7f21526827f651Patch

Published

Oct 11, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4300The scm_check_creds function in net/core/scm.c in the Linux …
• CVE-2013-4301includes/resourceloader/ResourceLoaderContext.php in MediaWi…
• CVE-2013-4302(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php…
• CVE-2013-4303includes/libs/IEUrlExtension.php in the MediaWiki API in Med…6.1
• CVE-2013-4304The CentralAuth extension for MediaWiki 1.19.x before 1.19.8…
• CVE-2013-4305Cross-site scripting (XSS) vulnerability in contrib/example.…
• CVE-2013-4307Multiple cross-site scripting (XSS) vulnerabilities in repo/…
• CVE-2013-4308Cross-site scripting (XSS) vulnerability in pages/TalkpageHi…
• CVE-2013-4309Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4310Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers…
• CVE-2013-4311libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, an…
• CVE-2013-4312The Linux kernel before 4.4.1 allows local users to bypass f…