Published: 15/11/2017 Updated: 28/11/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

MediaWiki prior to 1.27.4, 1.28.x prior to 1.28.3, and 1.29.x prior to 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote malicious users to enumerate account names and conduct brute-force attacks via a series of requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mediawiki mediawiki 1.28.1
mediawiki mediawiki
mediawiki mediawiki 1.29.0
mediawiki mediawiki 1.29.1
mediawiki mediawiki 1.28.0
mediawiki mediawiki 1.28.2
debian debian linux 9.0

MediaWiki before 1274, 128x before 1283, and 129x before 1292, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests ...

CWE-200 https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html https://www.debian.org/security/2017/dsa-4036 http://www.securitytracker.com/id/1039812 https://nvd.nist.gov https://security.archlinux.org/CVE-2017-8810

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-8810

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect