{"id":"CVE-2010-1150","aliases":["DEBIAN-CVE-2010-1150","DSA-2041-1","EUVD-2010-1181","GHSA-8fhg-54m9-q37r"],"status":"published","title":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly...","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","severity":{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01298,"percentile":0.70586,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2010-04-20T15:00:00Z","modified":"2026-10-23T17:47:47Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.15.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.15.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.15.3-1"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"mediawiki","fixed_in":["1:1.12.0-2lenny5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.15.3-1"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.12.0-2lenny5"}]}],"versions":["1:1.12.0-2lenny2","1:1.12.0-2lenny3","1:1.12.0-2lenny3~bpo40+1","1:1.12.0-2lenny4"]}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://www.vupen.com/english/advisories/2010/1055","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_0beta2/phase3/RELEASE-NOTES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_15_3/phase3/RELEASE-NOTES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.0beta2.patch.gz","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2010/04/08/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://download.wikimedia.org/mediawiki/1.15/mediawiki-1.15.3.patch.gz","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=23076","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2010/04/07/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=580418","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.debian.org/security/2010/dsa-2041","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1150"},{"url":"https://access.redhat.com/security/cve/CVE-2010-1150"},{"url":"https://github.com/advisories/GHSA-8fhg-54m9-q37r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-1150","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-1150","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2010-04-20T15:00:00Z","modified":"2024-08-07T01:14:06.275Z","updated_at":"2026-11-02T14:33:29.227451Z"}],"euvd":[{"id":"EUVD-2010-1181","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2010-04-20T15:00:00Z","modified":"2024-08-07T01:14:06Z","updated_at":"2026-11-03T01:39:42.741336Z"}],"ghsa":[{"id":"GHSA-8fhg-54m9-q37r","title":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly...","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2022-05-02T06:19:32Z","modified":"2023-02-10T05:06:02Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:54:00.716708Z"}],"nvd":[{"id":"CVE-2010-1150","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2010-04-20T15:30:00.367Z","modified":"2026-06-16T23:17:36.743Z","cvss":[{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:01:45.97784Z"}],"osv":[{"id":"CVE-2010-1150","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2010-04-20T15:30:00Z","modified":"2026-04-10T03:41:11.835417Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2010-1150","description":"MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a \"login CSRF\" issue.","status":"published","published":"2010-04-20T15:30:00.367Z","modified":"2026-10-23T17:47:47.191126774Z","updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"DSA-2041-1","title":"mediawiki - cross-site request forgery","status":"published","published":"2010-05-03T00:00:00Z","modified":"2026-03-09T01:22:01.460753Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}