Description

includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

Remediation

References

CVE-2014-2243

Related Vulnerabilities

PostgreSQL Improper Control of Dynamically-Managed Code Resources Vulnerability (CVE-2022-2625)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0185)

WordPress Plugin Auto Amazon Links-Amazon Associates Affiliate Unspecified Vulnerability (2.0.3.4)

WordPress Plugin OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Supply Chain Attack [Polyfill.io] (1.1.2)

Drupal Improper Removal of Sensitive Information Before Storage or Transfer Vulnerability (CVE-2022-31043)

Severity

Medium

Classification

CVE-2014-2243 CWE-362

Tags

Missing Update Known Vulnerabilities