CVE-2015-2940

EPSS 0.3%
Veröffentlicht 13.04.2015 14:59:13
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 10

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mediawiki ≫ Checkuser Version- SwPlatformmediawiki

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.3%	0.524

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://www.openwall.com/lists/oss-security/2015/04/01/1

http://www.openwall.com/lists/oss-security/2015/04/07/3

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

Patch

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:200

http://www.securityfocus.com/bid/73477

https://security.gentoo.org/glsa/201510-05

https://phabricator.wikimedia.org/T85858

https://nvd.nist.gov/vuln/detail/CVE-2015-2940

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-2940

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-2940

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2015-2940