CVE-2013-4572

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

• CWE-384

• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.htmlMailing List, Third Party Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.htmlMailing List, Third Party Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=53032Issue Tracking, Patch, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.htmlMailing List, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.htmlMailing List, Third Party Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.htmlMailing List, Third Party Advisory
• https://bugzilla.wikimedia.org/show_bug.cgi?id=53032Issue Tracking, Patch, Third Party Advisory

Published

Feb 6, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4566mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to no…
• CVE-2013-4567Incomplete blacklist vulnerability in Sanitizer::checkCss in…
• CVE-2013-4568Incomplete blacklist vulnerability in Sanitizer::checkCss in…
• CVE-2013-4569The CleanChanges extension for MediaWiki before 1.19.9, 1.20…
• CVE-2013-4570The zend_inline_hash_func function in php-luasandbox in the …
• CVE-2013-4571Buffer overflow in php-luasandbox in the Scribuntu extension…
• CVE-2013-4573Cross-site scripting (XSS) vulnerability in the ZeroRatedMob…
• CVE-2013-4574Cross-site scripting (XSS) vulnerability in the TimeMediaHan…
• CVE-2013-4575Heap-based buffer overflow in the utility program in the Lin…
• CVE-2013-4576GnuPG 1.x before 1.4.16 generates RSA keys using sequences o…
• CVE-2013-4577A certain Debian patch for GNU GRUB uses world-readable perm…
• CVE-2013-4578jarsigner in OpenJDK and Oracle Java SE before 7u51 allows r…