Description

The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.

Remediation

References

CVE-2015-6728

Related Vulnerabilities

Oracle Database Server CVE-2015-2586 Vulnerability (CVE-2015-2586)

WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2012-4448)

GlassFish Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-7182)

WordPress Plugin WooCommerce Security Bypass (4.6.1)

WordPress Plugin Essential Blocks-Page Builder Gutenberg Blocks, Patterns & Templates Cross-Site Request Forgery (4.0.6)

Severity

High

Classification

CVE-2015-6728 CWE-352

Tags

Missing Update Known Vulnerabilities