{"id":"CVE-2014-2243","aliases":["DEBIAN-CVE-2014-2243","EUVD-2014-2282","GHSA-3xwx-cwrm-pvfj","MGASA-2014-0124","UBUNTU-CVE-2014-2243"],"status":"published","title":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before...","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01548,"percentile":0.75192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2014-03-02T02:00:00Z","modified":"2026-10-23T15:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://openwall.com/lists/oss-security/2014/02/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=61346","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071136","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://openwall.com/lists/oss-security/2014/03/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f%2Cn%2Cz","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2243"},{"url":"https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z","tags":["report"]},{"url":"https://github.com/advisories/GHSA-3xwx-cwrm-pvfj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2243","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0124.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-2243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2243","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2243","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00.267Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2282","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-3xwx-cwrm-pvfj","title":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before...","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2022-05-17T04:51:23Z","modified":"2025-04-12T12:32:05Z","cwes":["CWE-362"],"updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-2243","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2014-03-02T04:57:25.917Z","modified":"2026-06-17T00:06:16.9Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-2243","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2014-03-02T04:57:25Z","modified":"2026-04-16T06:26:08.534726173Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2243","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"published","published":"2014-03-02T04:57:25.917Z","modified":"2026-10-23T15:47:29.23755134Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0124","title":"Updated mediawiki packages fix multiple vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nMediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML\nnamespace, in uploaded SVG files.  Some client software may use these\nnamespaces in a way that results in XSS.  This was fixed by disallowing\nuploading SVG files using non-whitelisted namespaces (CVE-2014-2242).\n\nMediaWiki before 1.22.3 performs token comparison that may be vulnerable to\ntiming attacks.  This was fixed by making token comparison use constant time\n(CVE-2014-2243).\n\nMediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due\nto flaw with link handling in api.php.  This was fixed such that it won't\nfind links in the middle of api.php links (CVE-2014-2244).\n","status":"published","published":"2014-03-07T20:12:00Z","modified":"2026-04-16T06:22:33.29325174Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-2243","description":"includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.","status":"withdrawn","published":"2014-03-02T04:57:00Z","modified":"2025-07-16T07:31:50.60053Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}