VULNERABILITY INTELLIGENCE

CVE-2014-2243

CVSS score5.8 MEDIUM
EPSS probability1.55%
CISA KEVNot currently listed
Published2014-03-02
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:N

Description

includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references