CVE-2015-8623 Cross-site request forgery in n/a
Remote attackers can bypass CSRF protection in MediaWiki by guessing edit tokens via timing attacks due to non-constant time comparisons.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-8623?
CVE-2015-8623 is a high-severity vulnerability in Mediawiki Mediawiki, published on 23 Mar 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
Weakness: CWE-352
Which versions are affected by CVE-2015-8623?
It affects 1 product.
Products include Mediawiki Mediawiki.
How do I fix CVE-2015-8623?
Upgrade to a fixed version.
Is CVE-2015-8623 being exploited?
There is no known exploitation of CVE-2015-8623 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as DEBIAN-CVE-2015-8623, GHSA-8h72-c6mj-ffxx.