Description


An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.

Related CPE's


a

mediawiki

mediawiki

2

o

debian

debian_linux

2

o

fedoraproject

fedora

2

Weaknesses



CWE-287

CVSS impact metrics


CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information


Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-04-06T07:15:12.497

4 years ago

Last modified

2023-11-07T03:32:59.730

1 year ago