CVE-2015-8009

Description

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• http://www.openwall.com/lists/oss-security/2015/10/29/14
• http://www.securitytracker.com/id/1034028
• https://phabricator.wikimedia.org/T103023
• http://www.openwall.com/lists/oss-security/2015/10/29/14
• http://www.securitytracker.com/id/1034028
• https://phabricator.wikimedia.org/T103023

CWEs

CWE-255

💬 Discuss CVE-2015-8009 on VIR Community →

Community-verified mitigations for this CVE will appear above when contributors publish them.