Description
An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.
Remediation
References
Related Vulnerabilities
WordPress Plugin WPGlobus Translate Options Cross-Site Scripting (2.1.0)
Squid Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-10003)
WordPress Plugin MobileChief-Mobile Site Builder Cross-Site Scripting (1.5.7)
WordPress Plugin yolink Search for WordPress 'bulkcrawl.php' SQL Injection (1.1.4)
Liferay Portal CVE-2021-38266 Vulnerability (CVE-2021-38266)