Description
An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.
Remediation
References
Related Vulnerabilities
MySQL CVE-2019-3009 Vulnerability (CVE-2019-3009)
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-2484)
WordPress Plugin WP-BlipBot Cross-Site Scripting (3.0.9)
WordPress Plugin WordPress Backup and Migrate-Backup Guard Cross-Site Scripting (1.1.46)
WordPress Plugin 301 Redirects-Easy Redirect Manager Cross-Site Request Forgery (2.72)