CVEvulnerability
CVE-2015-8628
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-03-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.
Affected configurations
• mediawiki mediawiki (<= 1.23.11)
• mediawiki mediawiki 1.24.0
• mediawiki mediawiki 1.24.1
• mediawiki mediawiki 1.24.2
• mediawiki mediawiki 1.24.3
• mediawiki mediawiki 1.24.4
• mediawiki mediawiki 1.25.0
• mediawiki mediawiki 1.25.1
• mediawiki mediawiki 1.25.2
• mediawiki mediawiki 1.25.3
• mediawiki mediawiki 1.26.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.openwall.com/lists/oss-security/2015/12/21/8 Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/12/23/7 Mailing List, Patch, Third Party Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html Patch, Release Notes, Vendor Advisory
- https://phabricator.wikimedia.org/T109724 Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/12/21/8 Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/12/23/7 Mailing List, Patch, Third Party Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html Patch, Release Notes, Vendor Advisory
- https://phabricator.wikimedia.org/T109724 Patch, Third Party Advisory