CVE-2015-8624: mediawiki Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2015-8624 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in mediawiki. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
-0.02 pp
From 0.77% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- mediawiki< 1:1.25.5-1
Mediawiki1 product
- mediawiki≤ 1.23.11 | 1.24.0 | 1.24.1 | 1.24.2 | 1.24.3 | 1.24.4 | 1.25.0 | 1.25.1 | 1.25.2 | 1.25.3 | 1.26.0
Ubuntu1 product
- mediawiki< 1:1.27.4-3
3 vendors · 3 products
References
7 links- lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.htmlMailing ListX Refsource MLISTPatchRelease NotesVendor Advisory
- www.openwall.com/lists/oss-security/2015/12/23/7Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2015/12/21/8Mailing ListX Refsource MLISTPatchThird Party Advisory
