Cross site request forgery (csrf)

2023-10-0906:15:00

PRIOn knowledge base

www.prio-n.com

mediawiki

sportsteams

csrf

special pages

5.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.

CPENameOperatorVersion
mediawikieq1.40.0
mediawikilt1.35.12
mediawikige1.36.0
mediawikilt1.39.5

Name	Operator	Version
mediawiki	eq	1.40.0
mediawiki	lt	1.35.12
mediawiki	ge	1.36.0
mediawiki	lt	1.39.5

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/952552/

phabricator.wikimedia.org/T345040