CVE-2015-8009

2017-07-2514:00:00

mitre

www.cve.org

9.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.3%

JSON

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer’s credentials by leveraging knowledge of the credentials.