Description

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.

Remediation

References

CVE-2015-8009

Related Vulnerabilities

Jboss EAP Cryptographic Issues Vulnerability (CVE-2014-0035)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-8569)

WordPress Plugin Survey Maker-Best WordPress Survey SQL Injection (1.5.5)

Atlassian Jira Improper Authentication Vulnerability (CVE-2021-39119)

WordPress Plugin File Groups 'fgid' Parameter SQL Injection (1.1.2)

Severity

Critical

Classification

CVE-2015-8009 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities