CVE-2015-8624
HighSummary
The User::matchEditToken function in MediaWiki before version 1.23.12 and 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
Risk Assessment
Attackers can exploit this vulnerability to carry out CSRF attacks, potentially leading to unauthorized changes in content or system settings.
Recommendation
It is recommended to update MediaWiki to the latest version to mitigate this vulnerability and implement additional CSRF protection mechanisms.
Other vulnerabilities in MediaWiki
See all- CVE-2026-34092High
A vulnerability in MediaWiki related to the exposure of sensitive information to unauthorized actors. It affects program files includes/Skin/Skin.Php.
- CVE-2026-34091High
CVE-2026-34091 describes an exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2026-34088High
CVE-2026-34088 involves the exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2017-8815High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- CVE-2017-8814High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'
- CVE-2017-8810High
MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
- CVE-2012-4380High
MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- CVE-2016-6337High
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
- CVE-2016-6335High
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
- CVE-2016-6332High
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
Original NVD description (English source)
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.