CVE-2015-2940

Published: Apr 13, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.

Affected (1)

Products: Mediawiki: Checkuser

Mediawiki

1 product

Checkuser

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Checkuser	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (14)

http://www.mandriva.com/security/advisories?name=MDVSA-2015:200

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/04/01/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/04/07/3

Source: cve@mitre.org

http://www.securityfocus.com/bid/73477

Source: cve@mitre.org

https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

Source: cve@mitre.org

PatchVendor Advisory

https://phabricator.wikimedia.org/T85858

Source: cve@mitre.org

https://security.gentoo.org/glsa/201510-05

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:200