Description

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.

Remediation

References

CVE-2016-6332

Related Vulnerabilities

Oracle Database Server CVE-2010-4423 Vulnerability (CVE-2010-4423)

WordPress Plugin N-Media Website Contact Form with File Upload Arbitrary File Upload (2.1)

Drupal Core 5.x Information Disclosure (5.0 - 5.18)

Jboss EAP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-9518)

PHP Other Vulnerability (CVE-2005-3392)

Severity

High

Classification

CVE-2016-6332 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities