~ / search / GHSA-rqvj-fc2x-99q6

GHSA-rqvj-fc2x-99q6

OATHAuth extension in MediaWiki is not implementing rate limit

Source: GitHub Advisory Database (reviewed) High CVE-2020-25827

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core >= 1.31.0, < 1.31.9 1.31.9
Packagist mediawiki/core >= 1.32.0, < 1.34.3 1.34.3

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

References

External links from the advisory. They lead to third-party sites.