Description

MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.

Remediation

References

CVE-2017-8810

Related Vulnerabilities

Joomla! Core 3.x.x Open Redirect (3.0.0 - 3.4.1)

YetiForce CRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-2890)

Drupal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-13675)

Django Improper Authentication Vulnerability (CVE-2021-44420)

WordPress Plugin Consulting Elementor Widgets SQL Injection (1.3.0)

Severity

High

Classification

CVE-2017-8810 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities