Description

MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.

Remediation

References

CVE-2017-8810

Related Vulnerabilities

SharePoint CVE-2024-38018 Vulnerability (CVE-2024-38018)

ATutor Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-10400)

PrestaShop Files or Directories Accessible to External Parties Vulnerability (CVE-2020-5250)

Django Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-0305)

WordPress Plugin Gwolle Guestbook Remote File Inclusion (1.5.3)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2017-8810