Lucene search

K

[email protected]NVD:CVE-2014-2665

HistoryApr 20, 2014 - 1:55 a.m.

CVE-2014-2665

2014-04-2001:55:06

CWE-287

[email protected]

web.nvd.nist.gov

1

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.8%

includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker’s account, as demonstrated by tracking the victim’s activity, related to a “login CSRF” issue.

Affected configurations

NVD

Node

mediawikimediawikiRange≤1.19.13

OR

mediawikimediawikiMatch1.19

OR

mediawikimediawikiMatch1.19beta_1

OR

mediawikimediawikiMatch1.19beta_2

OR

mediawikimediawikiMatch1.19.0

OR

mediawikimediawikiMatch1.19.1

OR

mediawikimediawikiMatch1.19.2

OR

mediawikimediawikiMatch1.19.3

OR

mediawikimediawikiMatch1.19.4

OR

mediawikimediawikiMatch1.19.5

OR

mediawikimediawikiMatch1.19.6

OR

mediawikimediawikiMatch1.19.7

OR

mediawikimediawikiMatch1.19.8

OR

mediawikimediawikiMatch1.19.9

OR

mediawikimediawikiMatch1.19.10

OR

mediawikimediawikiMatch1.19.11

OR

mediawikimediawikiMatch1.19.12

OR

mediawikimediawikiMatch1.20

OR

mediawikimediawikiMatch1.20.1

OR

mediawikimediawikiMatch1.20.2

OR

mediawikimediawikiMatch1.20.3

OR

mediawikimediawikiMatch1.20.4

OR

mediawikimediawikiMatch1.20.5

OR

mediawikimediawikiMatch1.20.6

OR

mediawikimediawikiMatch1.20.7

OR

mediawikimediawikiMatch1.20.8

OR

mediawikimediawikiMatch1.21

OR

mediawikimediawikiMatch1.21.1

OR

mediawikimediawikiMatch1.21.2

OR

mediawikimediawikiMatch1.21.3

OR

mediawikimediawikiMatch1.21.4

OR

mediawikimediawikiMatch1.21.5

OR

mediawikimediawikiMatch1.21.6

OR

mediawikimediawikiMatch1.21.7

OR

mediawikimediawikiMatch1.22.0

OR

mediawikimediawikiMatch1.22.1

OR

mediawikimediawikiMatch1.22.2

OR

mediawikimediawikiMatch1.22.3

OR

mediawikimediawikiMatch1.22.4

References

lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html

openwall.com/lists/oss-security/2014/03/28/1

openwall.com/lists/oss-security/2014/04/01/7

bugzilla.wikimedia.org/show_bug.cgi?id=62497

gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.8%

Related for NVD:CVE-2014-2665

nessus6 seebug1 securityvulns2 mageia1 openvas8 ubuntucve1 debiancve1 cve1 cvelist1 prion1 fedora2 debian1 osv1 gentoo1