CVEvulnerability
CVE-2015-8009
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-255
Description
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.
Affected configurations
• mediawiki mediawiki (<= 1.23.10)
• mediawiki mediawiki 1.24.0
• mediawiki mediawiki 1.24.1
• mediawiki mediawiki 1.24.2
• mediawiki mediawiki 1.24.3
• mediawiki mediawiki 1.25.0
• mediawiki mediawiki 1.25.1
• mediawiki mediawiki 1.25.2
Related
Weakness · not in database (1)
References
- http://www.openwall.com/lists/oss-security/2015/10/29/14 Mailing List, VDB Entry
- http://www.securitytracker.com/id/1034028 www.securitytracker.com
- https://phabricator.wikimedia.org/T103023 Exploit, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/10/29/14 Mailing List, VDB Entry
- http://www.securitytracker.com/id/1034028 www.securitytracker.com
- https://phabricator.wikimedia.org/T103023 Exploit, Third Party Advisory