CVE-2014-2665

includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14,
1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly
handle a correctly authenticated but unintended login attempt, which makes
it easier for remote authenticated users to obtain sensitive information by
arranging for a victim to login to the attacker’s account, as demonstrated
by tracking the victim’s activity, related to a “login CSRF” issue.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742857&gt;
• <https://bugs.launchpad.net/ubuntu/+source/mediawiki/+bug/1370227&gt;