CVE-2015-8623

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time…

published March 23, 2017

CVSS
—
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00731 · 53.5th percentile
Published
2017-03-23T20:00Z
EPSS history
Timeline
  • 23 MAR 20:00Z
    The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time…
    cvelistv5