CVE-2014-2665
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before...
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
Exploit likelihood
What each source reports
NVD Score used
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
CVE-2014-2665- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
CVE-2014-2665- Updated
- 2026-11-02
EUVDEUVD-2014-2697 No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
EUVD-2014-2697- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h9j9-33h5-rrmw No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before...
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
GHSA-h9j9-33h5-rrmw- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
CVE-2014-2665- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2665 No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
DEBIAN-CVE-2014-2665- Updated
- 2026-11-02
OSVMGASA-2014-0157 No score
Updated mediawiki packages fix CVE-2014-2665
Updated mediawiki packages fix security vulnerability:
Login CSRF issue in MediaWiki before 1.22.5 in Special:ChangePassword, whereby a user can be logged into an attackers account without being aware of it, allowing the attacker to track the user's activity (CVE-2014-2665).
MediaWiki has been updated to version 1.22.5, fixing this and other issues.
- Record
MGASA-2014-0157- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-2665 No score
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.
- Record
UBUNTU-CVE-2014-2665- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.14+dfsg-1 | 1:1.19.14+dfsg-1 |
mediawikiDebian:13 |
before 1:1.19.14+dfsg-1 | 1:1.19.14+dfsg-1 |
mediawikiDebian:14 |
before 1:1.19.14+dfsg-1 | 1:1.19.14+dfsg-1 |
mediawikiDebian:7 From an advisory covering 11 CVEs |
before 1:1.19.14+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 11 moreShow less1:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.14+dfsg-0+deb7u1 |
mediawiki-extensionsDebian:7 From an advisory covering 11 CVEs |
before 3.5~deb7u1, plus listed versions 2.113.03.13.23.3 Show 4 moreShow less3.43~exp13~exp23~exp3 |
3.5~deb7u1 |
mediawikiMageia:3 |
before 1.22.5-1.mga3 | 1.22.5-1.mga3 |
mediawikiMageia:4 |
before 1.22.5-1.mga4 | 1.22.5-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2665 is a medium vulnerability (CVSS 4.0) in Mediawiki, published March 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in mediawiki 1:1.19.14+dfsg-1.