5.8
CVE-2011-1766
- EPSS 2.23%
- Veröffentlicht 23.05.2011 22:55:01
- Zuletzt bearbeitet 16.06.2026 23:29:59
- Erkennungen
Loginincludes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.23% | 0.805 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060435.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060496.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060507.html
http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-May/000098.html
http://secunia.com/advisories/44684
http://www.securityfocus.com/bid/47722
https://bugzilla.redhat.com/show_bug.cgi?id=702512
https://bugzilla.wikimedia.org/show_bug.cgi?id=28639