Description

MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.

Remediation

References

CVE-2010-1150

Related Vulnerabilities

WordPress Plugin Comment Extra Fields 'cef-upload.php' Arbitrary File Upload (1.7)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7741)

WordPress Plugin MAC PHOTO GALLERY 'albid' Parameter Arbitrary File Disclosure (2.8)

WordPress Plugin Timetable and Event Schedule by MotoPress Cross-Site Request Forgery (2.4.1)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2021-44040)

Severity

Medium

Classification

CVE-2010-1150 CWE-352

Tags

Missing Update Known Vulnerabilities