NVD

Id
27572  
Name
CVE-2015-6728  
Description
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-09-01  
Modified Date
2016-12-07  
Seq
2015-6728  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
144555 27572 CVE-2015-6728 FEDORA-2015-13920  View
144556 27572 CVE-2015-6728 [oss-security] 20150812 CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10  View
144557 27572 CVE-2015-6728 [oss-security] 20150827 Re: CVE Request: MediaWiki 1.25.2, 1.24.3, 1.23.10  View
144558 27572 CVE-2015-6728 76334  View
144559 27572 CVE-2015-6728 [MediaWiki-announce] 20150810 MediaWiki Security and Maintenance Releases: 1.25.2, 1.24.3, 1.23.10  View
144560 27572 CVE-2015-6728 GLSA-201510-05  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
9228 JVNDB-2015-004548 MediaWiki の ApiBase::getWatchlistUser 機能におけるウォッチリストトークンを推測される脆弱性 MediaWiki の ApiBase::getWatchlistUser 機能は、一定時間トークンを比較しないため、ウォッチリストトークンを推測される、および CSRF 保護を回避される脆弱性が存在します。 CVE-2015-6728 83953 CVE-2015-6728 27572 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-004548.html 2015-08-10 2015-09-03 View