VULNERABILITY INTELLIGENCE
CVE-2015-8009
CVSS score9.8 CRITICAL
EPSS probability2.57%
CISA KEVNot currently listed
Published2017-07-25
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's credentials by leveraging knowledge of the credentials.
Primary references
- cve@mitre.org — Mailing List, VDB Entry
- cve@mitre.org
- cve@mitre.org — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory