Description

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.

Remediation

References

CVE-2015-8009

Related Vulnerabilities

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2019-17531)

Django Improper Authentication Vulnerability (CVE-2014-0482)

Lodash Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Vulnerability (CVE-2020-8203)

Craft CMS Missing Encryption of Sensitive Data Vulnerability (CVE-2018-20465)

WordPress Plugin Responsive Image Slider, Photo Gallery And Carousel Security Bypass (1.3.5)

Severity

Critical

Classification

CVE-2015-8009 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities