Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2014-2665
HistoryApr 20, 2014 - 1:55 a.m.

CVE-2014-2665

2014-04-2001:55:06
CWE-287
[email protected]
web.nvd.nist.gov
27
cve-2014-2665
mediawiki
login csrf
security issue
remote authenticated users
sensitive information

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.0%

JSON

includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker’s account, as demonstrated by tracking the victim’s activity, related to a β€œlogin CSRF” issue.

Affected configurations

NVD
Node
mediawikimediawikiRange≀1.19.13
OR
mediawikimediawikiMatch1.19
OR
mediawikimediawikiMatch1.19beta_1
OR
mediawikimediawikiMatch1.19beta_2
OR
mediawikimediawikiMatch1.19.0
OR
mediawikimediawikiMatch1.19.1
OR
mediawikimediawikiMatch1.19.2
OR
mediawikimediawikiMatch1.19.3
OR
mediawikimediawikiMatch1.19.4
OR
mediawikimediawikiMatch1.19.5
OR
mediawikimediawikiMatch1.19.6
OR
mediawikimediawikiMatch1.19.7
OR
mediawikimediawikiMatch1.19.8
OR
mediawikimediawikiMatch1.19.9
OR
mediawikimediawikiMatch1.19.10
OR
mediawikimediawikiMatch1.19.11
OR
mediawikimediawikiMatch1.19.12
OR
mediawikimediawikiMatch1.20
OR
mediawikimediawikiMatch1.20.1
OR
mediawikimediawikiMatch1.20.2
OR
mediawikimediawikiMatch1.20.3
OR
mediawikimediawikiMatch1.20.4
OR
mediawikimediawikiMatch1.20.5
OR
mediawikimediawikiMatch1.20.6
OR
mediawikimediawikiMatch1.20.7
OR
mediawikimediawikiMatch1.20.8
OR
mediawikimediawikiMatch1.21
OR
mediawikimediawikiMatch1.21.1
OR
mediawikimediawikiMatch1.21.2
OR
mediawikimediawikiMatch1.21.3
OR
mediawikimediawikiMatch1.21.4
OR
mediawikimediawikiMatch1.21.5
OR
mediawikimediawikiMatch1.21.6
OR
mediawikimediawikiMatch1.21.7
OR
mediawikimediawikiMatch1.22.0
OR
mediawikimediawikiMatch1.22.1
OR
mediawikimediawikiMatch1.22.2
OR
mediawikimediawikiMatch1.22.3
OR
mediawikimediawikiMatch1.22.4

Related

nessus 6
seebug 1
mageia 1
securityvulns 2
nvd 1
ubuntucve 1
openvas 8
cvelist 1
prion 1
debiancve 1
fedora 2
debian 1
osv 1
gentoo 1
nessus
nessus
Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:083)
2014-05-09 00:00:00
Fedora 19 : mediawiki-1.21.8-1.fc19 (2014-4511)
2014-04-09 00:00:00
Fedora 20 : mediawiki-1.21.8-1.fc20 (2014-4478)
2014-04-09 00:00:00
seebug
seebug
MediaWiki 'Special:ChangePassword'跨站请求δΌͺι€ ζΌζ΄ž
2014-04-08 00:00:00
mageia
mageia
Updated mediawiki packages fix CVE-2014-2665
2014-04-03 17:29:32
securityvulns
securityvulns
[ MDVSA-2014:083 ] mediawiki
2014-05-10 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2014-05-10 00:00:00
nvd
nvd
CVE-2014-2665
2014-04-20 01:55:06
ubuntucve
ubuntucve
CVE-2014-2665
2014-04-20 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2014-0157)
2022-01-28 00:00:00
Fedora Update for mediawiki FEDORA-2014-4478
2014-04-10 00:00:00
Fedora Update for mediawiki FEDORA-2014-4511
2014-04-10 00:00:00
cvelist
cvelist
CVE-2014-2665
2014-04-20 01:00:00
prion
prion
Cross site request forgery (csrf)
2014-04-20 01:55:00
debiancve
debiancve
CVE-2014-2665
2014-04-20 01:55:06
fedora
fedora
[SECURITY] Fedora 19 Update: mediawiki-1.21.8-1.fc19
2014-04-09 01:03:53
[SECURITY] Fedora 20 Update: mediawiki-1.21.8-1.fc20
2014-04-09 01:00:28
debian
debian
[SECURITY] [DSA 2891-3] mediawiki regression update
2014-04-04 18:02:59
osv
osv
mediawiki - security update
2014-03-30 00:00:00
gentoo
gentoo
MediaWiki: Multiple vulnerabilities
2015-02-07 00:00:00

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.0%

JSON
Related for CVE-2014-2665
nessus6seebug1mageia1securityvulns2nvd1ubuntucve1openvas8cvelist1prion1debiancve1fedora2debian1osv1gentoo1