CVE-2010-1648: CSRF

Published Jun 7, 2010

Updated

Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.

Affected Software

8 affected components

MediaWiki MediaWiki=1.16.0-beta2

MediaWiki MediaWiki=1.15.1

MediaWiki MediaWiki=1.15.0-rc1

MediaWiki MediaWiki=1.15.0

MediaWiki MediaWiki=1.15.3

MediaWiki MediaWiki=1.15.2

MediaWiki MediaWiki=1.16.0

MediaWiki MediaWiki=1.16.0-beta1

Remediation

Patch Available

http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html

Event History

Jun 7, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Jun 8, 2010

Data Sourced

via NVD·12:30 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1648?

CVE-2010-1648 is rated as a medium severity vulnerability due to its potential to compromise user accounts through CSRF attacks.

How do I fix CVE-2010-1648?

To fix CVE-2010-1648, upgrade MediaWiki to version 1.15.4 or 1.16 beta 3 or later, which addresses the CSRF vulnerability.

Which versions of MediaWiki are affected by CVE-2010-1648?

CVE-2010-1648 affects MediaWiki versions 1.15.0 to 1.15.3 and 1.16.0 beta 1 and 2.

What type of vulnerability is CVE-2010-1648?

CVE-2010-1648 is a cross-site request forgery (CSRF) vulnerability that allows attackers to hijack user authentication.

What can an attacker do with CVE-2010-1648?

An attacker exploiting CVE-2010-1648 can create accounts or reset passwords, effectively compromising user accounts.