6.8

CVE-2010-1648

Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mediawiki ≫ Mediawiki Version 1.15.0
Mediawiki ≫ Mediawiki Version 1.15.0 Update rc1
Mediawiki ≫ Mediawiki Version 1.15.1
Mediawiki ≫ Mediawiki Version 1.15.2
Mediawiki ≫ Mediawiki Version 1.15.3
Mediawiki ≫ Mediawiki Version 1.16.0
Mediawiki ≫ Mediawiki Version 1.16.0 Update beta1
Mediawiki ≫ Mediawiki Version 1.16.0 Update beta2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.445
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043803.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043856.html
http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html
Patch
Vendor Advisory
https://bugzilla.wikimedia.org/show_bug.cgi?id=23371