CVE-2015-8009
Vulnerability from cvelistv5
Published
2017-07-25 14:00
Modified
2024-08-06 08:06
Severity ?
EPSS score ?
Summary
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | http://www.openwall.com/lists/oss-security/2015/10/29/14 | Mailing List, VDB Entry | |
cve@mitre.org | http://www.securitytracker.com/id/1034028 | ||
cve@mitre.org | https://phabricator.wikimedia.org/T103023 | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2015/10/29/14 | Mailing List, VDB Entry | |
af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1034028 | ||
af854a3a-2127-422b-91ae-364da2661108 | https://phabricator.wikimedia.org/T103023 | Exploit, Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T08:06:31.525Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "1034028", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id/1034028" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://phabricator.wikimedia.org/T103023" }, { "name": "[oss-security] 20151029 Re: CVE Request: MediaWiki 1.25.3, 1.24.4 and 1.23.11", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/14" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2015-10-19T00:00:00", "descriptions": [ { "lang": "en", "value": "The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer\u0027s credentials by leveraging knowledge of the credentials." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2017-09-14T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "1034028", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id/1034028" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://phabricator.wikimedia.org/T103023" }, { "name": "[oss-security] 20151029 Re: CVE Request: MediaWiki 1.25.3, 1.24.4 and 1.23.11", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2015/10/29/14" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8009", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer\u0027s credentials by leveraging knowledge of the credentials." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "1034028", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1034028" }, { "name": "https://phabricator.wikimedia.org/T103023", "refsource": "CONFIRM", "url": "https://phabricator.wikimedia.org/T103023" }, { "name": "[oss-security] 20151029 Re: CVE Request: MediaWiki 1.25.3, 1.24.4 and 1.23.11", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/10/29/14" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8009", "datePublished": "2017-07-25T14:00:00", "dateReserved": "2015-10-28T00:00:00", "dateUpdated": "2024-08-06T08:06:31.525Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2015-8009\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-07-25T14:29:00.223\",\"lastModified\":\"2024-11-21T02:37:50.460\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer\u0027s credentials by leveraging knowledge of the credentials.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n MWOAuthDataStore::lookup_token Extension:OAuth para MediaWiki versi\u00f3n 1.25.x anterior a 1.25.3, versi\u00f3n 1.24.x anterior a 1.24.4 y anterior a versi\u00f3n 1.23.11, no comprueba apropiadamente la firma cuando verifica la firma de autorizaci\u00f3n, lo que permite a los consumidores registrados remotos utilizar las credenciales de otro consumidor mediante el aprovechamiento el conocimiento de las credenciales.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-255\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.23.10\",\"matchCriteriaId\":\"FE35D692-87E9-4982-AA23-27EBD5E5EEE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B21EB21-AE87-48BF-B4A1-5E63A2E116B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6C00423-B3FE-485A-9014-22F409DBD377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E90C95FB-71CA-4CA1-935D-58A08244A81F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.24.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DDBD41F-C2D5-4D7C-B069-FBC2C8EBB81C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9129F374-93CB-43CE-A3B2-DB6483514F32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE125142-10A2-4ACF-9BA4-44E63C1E5DB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediawiki:mediawiki:1.25.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF21D6EE-CEAC-42A7-99B6-D9D033E1FEC6\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2015/10/29/14\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1034028\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://phabricator.wikimedia.org/T103023\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2015/10/29/14\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1034028\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://phabricator.wikimedia.org/T103023\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.