PT-2019-4686 · Mediawiki · Mediawiki Oauth2 Client Extension

Justin Bull · Published 2019-08-19 · Updated 2023-03-08 · CVE-2019-15150

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaWiki OAuth2 Client extension versions prior to 0.4

Description A CSRF issue exists due to the OAuth2 state parameter not being checked in the callback function, allowing a remote attacker to perform a cross-site request forgery. This could potentially enable an attacker to carry out actions on behalf of another user without their knowledge or consent.

Recommendations For versions prior to 0.4, update to version 0.4 or later to resolve the issue. As a temporary workaround, consider implementing additional validation checks for the OAuth2 state parameter in the callback function to prevent CSRF attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2020-01058

CVE-2019-15150

Affected Products

Mediawiki Oauth2 Client Extension

References · 12

• https://github.com/Schine/MW-OAuth2Client/commit/6a4fe4500ddd72ad4e826d9d63b2d69512bd10d1 · Patch
• https://bdu.fstec.ru/vul/2020-01058 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15150 · Security Note
• https://github.com/Schine/MW-OAuth2Client/releases/tag/v0.4 · Note
• http://openwall.com/lists/oss-security/2019/08/19/1 · Note
• http://seclists.org/fulldisclosure/2019/Aug/25 · Note
• https://seclists.org/bugtraq/2019/Aug/32 · Note
• https://t.me/defcon_news/22950 · Telegram Post
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-15150&scoretype=cvssv2 · Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-15150&scoretype=cvssv2 · Note
• http://packetstormsecurity.com/files/154140/MediaWiki-OAuth2-Client-0.3-Cross-Site-Request-Forgery.html · Note