CVE-2015-6728: CSRF
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6728?
CVE-2015-6728 has a medium severity level as it allows remote attackers to potentially bypass CSRF protection.
How do I fix CVE-2015-6728?
To fix CVE-2015-6728, upgrade to MediaWiki versions 1.23.10, 1.24.3, or 1.25.2 or later.
What type of attack is associated with CVE-2015-6728?
CVE-2015-6728 is associated with timing attacks that exploit non-constant-time token comparison.
Which versions of MediaWiki are affected by CVE-2015-6728?
CVE-2015-6728 affects MediaWiki versions prior to 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2.
What are the implications of CVE-2015-6728 for users?
Users affected by CVE-2015-6728 may experience increased vulnerability to CSRF attacks due to inadequate token protection.