NVD

Id
8653  
Name
CVE-2011-1766  
Description
includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-05-23  
Modified Date
2011-06-15  
Seq
2011-1766  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
49941 8653 CVE-2011-1766 FEDORA-2011-6781  View
49942 8653 CVE-2011-1766 FEDORA-2011-6774  View
49943 8653 CVE-2011-1766 FEDORA-2011-6775  View
49944 8653 CVE-2011-1766 [mediawiki-announce] 20110505 MediaWiki security release 1.16.5  View
49945 8653 CVE-2011-1766 47722  View
49946 8653 CVE-2011-1766 https://bugzilla.redhat.com/show_bug.cgi?id=702512  View
49947 8653 CVE-2011-1766 https://bugzilla.wikimedia.org/show_bug.cgi?id=28639  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34305 JVNDB-2011-004547 MediaWiki における認証を回避される脆弱性 MediaWiki は、wgBlockDisablesLogin が有効な際、auth トークンの失敗の検証後、特定のキャッシュデータがクリアされないため、認証を回避される脆弱性が存在します。 CVE-2011-1766 49673 CVE-2011-1766 8653 5.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004547.html 2011-05-23 2012-03-27 View