CVE-2011-1766

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token…

published May 23, 2011

CVSS
—
EPSS
2%
Percentile
82.5
In the wild
Unconfirmed
What it is

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02232 · 82.5th percentile
Published
2011-05-23T22:00Z
EPSS history
Timeline
  • 23 MAY 22:00Z
    includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token…
    cvelistv5