CVE-2015-8009
CriticalSummary
The MWOAuthDataStore::lookup_token function in the OAuth extension for MediaWiki versions 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature. This allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of those credentials.
Risk Assessment
This vulnerability poses a risk of unauthorized access to data, potentially leading to breaches of confidentiality within the organization. Remote attackers may gain access to resources that should not be available to them.
Recommendation
It is recommended to update the OAuth extension to the latest version to ensure proper validation of authorization signatures. Additionally, conducting an audit of access to Consumer credentials is advisable.
Original NVD description (English source)
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.