VulnerabilityModified
CVE-2010-2787
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache…
MEDIUM 4.3EPSS 1.65%
Does this matter?
Lower severity and a low EPSS score (1.65%). Track it; it rarely justifies an emergency change on its own.
Description
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 1.65% probability · 75th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- mediawiki/mediawiki
- Source
- secalert@redhat.com
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlPatch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlPatch, Vendor Advisory
- http://openwall.com/lists/oss-security/2010/07/29/4Patch
- http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69776Patch
- http://www.securityfocus.com/bid/42019Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=620224Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=620226Patch
- https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlPatch
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlPatch, Vendor Advisory
- http://openwall.com/lists/oss-security/2010/07/29/4Patch
- http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69776Patch
- http://www.securityfocus.com/bid/42019Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=620224Patch
- https://bugzilla.redhat.com/show_bug.cgi?id=620226Patch
- https://bugzilla.wikimedia.org/show_bug.cgi?id=24565
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.