CVE-2015-8624: CSRF
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8624?
CVE-2015-8624 has a moderate severity rating due to the potential for token enumeration attacks.
How do I fix CVE-2015-8624?
To fix CVE-2015-8624, upgrade MediaWiki to version 1.23.12, 1.24.5, 1.25.4, or 1.26.1 or later.
What types of software are affected by CVE-2015-8624?
CVE-2015-8624 affects MediaWiki versions from 1.23.11 and below, including specific versions in the 1.24.x, 1.25.x, and 1.26.x series.
Can CVE-2015-8624 lead to data exposure?
Yes, CVE-2015-8624 can potentially allow attackers to guess user tokens, which may lead to unauthorized access or data exposure.
What component of MediaWiki is vulnerable in CVE-2015-8624?
The vulnerability exists in the User::matchEditToken function in includes/User.php.