Brute-force Vulnerability in MediaWiki Affects Private Wiki Configurations
CVE-2017-8810
7.5HIGH
Key Information:
- Vendor
Mediawiki
- Vendor
- CVE Published:
- 15 November 2017
What is CVE-2017-8810?
A flaw in MediaWiki allows attackers to exploit responses from failed login attempts in private wiki configurations, revealing whether a username exists. This discrepancy enables unauthorized users to guess valid usernames, facilitating brute-force attack strategies that could compromise accounts through repeated login attempts. The affected versions include MediaWiki prior to 1.27.4, in the 1.28.x series before 1.28.3, and in the 1.29.x series before 1.29.2.
Affected Version(s)
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2