The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade www-apps/mediawiki. | Oct 30, 2017 | May 23, 2011 |
| Mediawiki | — | Upgrade MediaWiki to the latest version | Aug 24, 2017 | May 23, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub