CVE-2015-8624: CSRF

Published Mar 23, 2017
·
Updated

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.

Affected Software

11 affected components
MediaWiki MediaWiki<=1.23.11
MediaWiki MediaWiki=1.24.0
MediaWiki MediaWiki=1.24.1
MediaWiki MediaWiki=1.24.2
MediaWiki MediaWiki=1.24.3
MediaWiki MediaWiki=1.24.4
MediaWiki MediaWiki=1.25.0
MediaWiki MediaWiki=1.25.1
MediaWiki MediaWiki=1.25.2
MediaWiki MediaWiki=1.25.3
MediaWiki MediaWiki=1.26.0

Event History

Mar 23, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2015-8624?

CVE-2015-8624 has a moderate severity rating due to the potential for token enumeration attacks.

2

How do I fix CVE-2015-8624?

To fix CVE-2015-8624, upgrade MediaWiki to version 1.23.12, 1.24.5, 1.25.4, or 1.26.1 or later.

3

What types of software are affected by CVE-2015-8624?

CVE-2015-8624 affects MediaWiki versions from 1.23.11 and below, including specific versions in the 1.24.x, 1.25.x, and 1.26.x series.

4

Can CVE-2015-8624 lead to data exposure?

Yes, CVE-2015-8624 can potentially allow attackers to guess user tokens, which may lead to unauthorized access or data exposure.

5

What component of MediaWiki is vulnerable in CVE-2015-8624?

The vulnerability exists in the User::matchEditToken function in includes/User.php.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203