CVE-2015-8628

MEDIUM

MediaWiki < 1.23.12, 1.24.x < 1.24.5, 1.25.x < 1.25.4, 1.26.x < 1.26.1 - Sensitive User Login Info Exposure

Title source: llm
STIX 2.1

Description

The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.

References (4)

Core 4
Core References
Patch, Release Notes, Vendor Advisory mailing-list x_refsource_mlist
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/23/7
Patch, Third Party Advisory x_refsource_confirm
https://phabricator.wikimedia.org/T109724
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/21/8

Scores

CVSS v3 5.3
EPSS 0.0043
EPSS Percentile 63.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (11)
mediawiki/mediawiki 1.24.0
mediawiki/mediawiki 1.24.1
mediawiki/mediawiki 1.24.2
mediawiki/mediawiki 1.24.3
mediawiki/mediawiki 1.24.4
mediawiki/mediawiki 1.25.0
mediawiki/mediawiki 1.25.1
mediawiki/mediawiki 1.25.2
mediawiki/mediawiki 1.25.3
mediawiki/mediawiki 1.26.0
... and 1 more
Published Mar 23, 2017
Tracked Since Feb 18, 2026