vulnerability
MediaWiki: Cross-Site Request Forgery (CSRF) (CVE-2015-8623)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Mar 23, 2017 | Aug 24, 2017 | May 13, 2022 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Mar 23, 2017
Added
Aug 24, 2017
Modified
May 13, 2022
Description
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
Solution
mediawiki-upgrade-latest
References
- CVE-2015-8623
- https://attackerkb.com/topics/CVE-2015-8623
- URL-http://www.openwall.com/lists/oss-security/2015/12/21/8
- URL-http://www.openwall.com/lists/oss-security/2015/12/23/7
- URL-https://gerrit.wikimedia.org/r/#/c/156336/5/includes/User.php
- URL-https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
- URL-https://phabricator.wikimedia.org/T119309
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.