| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | = 1.19= 1.19.0= 1.19.1= 1.19.10= 1.19.11= 1.19.12= 1.19.2= 1.19.3= 1.19.4= 1.19.5= 1.19.6= 1.19.7= 1.19.8= 1.19.9= 1.20= 1.20.1= 1.20.2= 1.20.3= 1.20.4= 1.20.5= 1.20.6= 1.20.7= 1.20.8= 1.21= 1.21.1= 1.21.2= 1.21.3= 1.21.4= 1.21.5= 1.21.6= 1.21.7= 1.22.0= 1.22.1= 1.22.2= 1.22.3= 1.22.4≤ 1.19.13 |
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free