CVE-2015-8623
Description
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-8623
Vendor advisory: cve@mitre.org — https://phabricator.wikimedia.org/T119309
Vendor advisory: cve@mitre.org — https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
Vendor advisory: cve@mitre.org — http://www.openwall.com/lists/oss-security/2015/12/23/7
Vendor advisory: cve@mitre.org — http://www.openwall.com/lists/oss-security/2015/12/21/8
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1:1.25.5-1 |
| debian | bullseye | fixed | 1:1.25.5-1 |
| debian | forky | fixed | 1:1.25.5-1 |
| debian | sid | fixed | 1:1.25.5-1 |
| debian | trixie | fixed | 1:1.25.5-1 |
References
- http://www.openwall.com/lists/oss-security/2015/12/21/8
- http://www.openwall.com/lists/oss-security/2015/12/23/7
- https://gerrit.wikimedia.org/r/#/c/156336/5/includes/User.php
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html
- https://phabricator.wikimedia.org/T119309
- https://security-tracker.debian.org/tracker/CVE-2015-8623
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.