CVEvulnerability
CVE-2015-6728
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-09-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
Affected configurations
• mediawiki mediawiki (<= 1.23.9)
• mediawiki mediawiki 1.24.0
• mediawiki mediawiki 1.24.1
• mediawiki mediawiki 1.24.2
• mediawiki mediawiki 1.25.0
• mediawiki mediawiki 1.25.1
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html lists.fedoraproject.org
- http://www.openwall.com/lists/oss-security/2015/08/12/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/08/27/6 www.openwall.com
- http://www.securityfocus.com/bid/76334 www.securityfocus.com
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html Vendor Advisory
- https://security.gentoo.org/glsa/201510-05 security.gentoo.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html lists.fedoraproject.org
- http://www.openwall.com/lists/oss-security/2015/08/12/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/08/27/6 www.openwall.com
- http://www.securityfocus.com/bid/76334 www.securityfocus.com
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html Vendor Advisory
- https://security.gentoo.org/glsa/201510-05 security.gentoo.org