Description
The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.
References
- 77379 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1273353
- FEDORA-2015-ec6d598d3d vendor-advisory
- FEDORA-2015-97fe05f788 vendor-advisory
- 1034028 vdb-entry
- https://phabricator.wikimedia.org/T103022
- [MediaWiki-announce] 20151016 Extension Security Release: OAuth, Echo, PageTriage mailing-list
- FEDORA-2015-24fe8b66c9 vendor-advisory
- [oss-security] 20151029 Re: CVE Request: MediaWiki 1.25.3, 1.24.4 and 1.23.11 mailing-list