CVE-2017-8810
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.15% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- mediawiki/mediawiki · debian/debian linux
- Source
- security@debian.org
References
- http://www.securitytracker.com/id/1039812Third Party Advisory, VDB Entry
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.htmlMailing List, Patch, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4036Third Party Advisory
- http://www.securitytracker.com/id/1039812Third Party Advisory, VDB Entry
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.htmlMailing List, Patch, Vendor Advisory
- https://www.debian.org/security/2017/dsa-4036Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.