VULNERABILITY INTELLIGENCE

CVE-2015-6728

CVSS score7.5 HIGH
EPSS probability0.86%
CISA KEVNot currently listed
Published2015-09-01
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references