CVE-2015-6728
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1...
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
Exploit likelihood
What each source reports
NVD Score used
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
CVE-2015-6728- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
CVE-2015-6728- Updated
- 2026-11-02
EUVDEUVD-2015-6666 No score
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
EUVD-2015-6666- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j8wf-wp2j-cmg7 No score
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1...
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
GHSA-j8wf-wp2j-cmg7- Weakness
- CWE-352
- Updated
- 2026-11-02
OSV No score
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
CVE-2015-6728- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-6728 No score
The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.
- Record
DEBIAN-CVE-2015-6728- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6728 is a high vulnerability (CVSS 7.5) in Mediawiki, published September 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in mediawiki 1:1.25.5-1.
References
security.gentoo.org/glsa/201510-05
openwall.com/lists/oss-security/2015/08/27/6
lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html
lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html
securityfocus.com/bid/76334
nvd.nist.gov/vuln/detail/CVE-2015-6728
github.com/advisories/GHSA-j8wf-wp2j-cmg7
security-tracker.debian.org/tracker/CVE-2015-6728