Description
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
References (4)
Core 4
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.wikimedia.org/show_bug.cgi?id=53032
Mailing List, Third Party Advisory x_refsource_misc
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html
Mailing List, Third Party Advisory x_refsource_misc
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html
Mailing List, Third Party Advisory x_refsource_confirm
http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
Scores
CVSS v3
7.5
EPSS
0.0129
EPSS Percentile
79.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-384
Status
published
Products (3)
fedoraproject/fedora
18
fedoraproject/fedora
19
mediawiki/mediawiki
< 1.19.9
Published
Feb 06, 2020
Tracked Since
Feb 18, 2026