NVD

Id
83900  
Name
CVE-2015-8623  
Description
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-03-29  
Published
2017-03-23  
Modified Date
2017-03-27  
Seq
2015-8623  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
411926 83900 CVE-2017-5938 openSUSE-SU-2017:0501  View
411927 83900 CVE-2017-5938 DSA-3784  View
411928 83900 CVE-2017-5938 [oss-security] 20170208 Re: CVE request: XSS in viewvc  View
411929 83900 CVE-2017-5938 96185  View
411930 83900 CVE-2017-5938 https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad  View
411931 83900 CVE-2017-5938 https://github.com/viewvc/viewvc/releases/tag/1.1.26  View
411932 83900 CVE-2017-5938 openSUSE-SU-2017:0501  View
411933 83900 CVE-2017-5938 DSA-3784  View
411934 83900 CVE-2017-5938 [oss-security] 20170208 Re: CVE request: XSS in viewvc  View
411935 83900 CVE-2017-5938 96185  View
411936 83900 CVE-2017-5938 https://github.com/viewvc/viewvc/commit/9dcfc7daa4c940992920d3b2fbd317da20e44aad  View
411937 83900 CVE-2017-5938 https://github.com/viewvc/viewvc/releases/tag/1.1.26  View

Related JVN