Description

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.

Remediation

References

CVE-2015-8009

Related Vulnerabilities

Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-2660)

WordPress CVE-2020-28033 Vulnerability (CVE-2020-28033)

WordPress Plugin Slideshow Gallery LITE Multiple Unspecified Vulnerabilities (1.5.3.3)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3389)

Python CVE-2019-16056 Vulnerability (CVE-2019-16056)

Severity

Critical

Classification

CVE-2015-8009 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities