CVE-2015-8008

High

Published: 29/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, allowing attackers to bypass intended IP address access restrictions.

Risk Assessment

Attackers may gain access to resources that should be protected, potentially leading to unauthorized data access.

Recommendation

It is recommended to update the OAuth extension to the latest version and implement additional security measures to restrict access based on IP address.

Other vulnerabilities in MediaWiki OAuth extension

CVE-2015-8009Critical
The MWOAuthDataStore::lookup_token function in the OAuth extension for MediaWiki versions 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature. This allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of those credentials.

Original NVD description (English source)

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.