Description
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
Remediation
References
Related Vulnerabilities
MySQL CVE-2016-5442 Vulnerability (CVE-2016-5442)
Microsoft SQL Server Other Vulnerability (CVE-2002-0056)
WordPress Plugin WP Support Plus Responsive Ticket System Security Bypass (7.1.4)
WordPress Plugin Custom Content Type Manager 'upload_form.php' Arbitrary File Upload (0.9.5.13)
WordPress Plugin Instagram Plugin-InstaLinker Cross-Site Scripting (1.1.1)