CVE-2010-2787
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private...
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
Exploit likelihood
What each source reports
NVD Score used
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
CVE-2010-2787- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
CVE-2010-2787- Updated
- 2026-11-02
EUVDEUVD-2010-2791 No score
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
EUVD-2010-2791- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4c6h-6j8p-jf37 No score
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private...
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
GHSA-4c6h-6j8p-jf37- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
CVE-2010-2787- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-2787 No score
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.
- Record
DEBIAN-CVE-2010-2787- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2787 is a medium vulnerability (CVSS 4.3) in Mediawiki, published April 27, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in mediawiki 1:1.15.5-1.
References
lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.html
bugzilla.redhat.com/show_bug.cgi?id=620226
openwall.com/lists/oss-security/2010/07/29/4
svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69776
bugzilla.wikimedia.org/show_bug.cgi?id=24565
Show 8 moreShow less
lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.html
securityfocus.com/bid/42019
nvd.nist.gov/vuln/detail/CVE-2010-2787
github.com/advisories/GHSA-4c6h-6j8p-jf37
security-tracker.debian.org/tracker/CVE-2010-2787