Description

api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.

Remediation

References

CVE-2010-2787

Related Vulnerabilities

ATutor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23341)

Oracle JRE CVE-2013-5778 Vulnerability (CVE-2013-5778)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-38263)

WordPress Plugin Easy Modal Multiple SQL Injection Vulnerabilities (2.0.17)

WordPress Plugin WP Human Resource Management Security Bypass (2.2.5)

Severity

Medium

Classification

CVE-2010-2787 CWE-200

Tags

Missing Update Known Vulnerabilities