{"id":"CVE-2015-8628","aliases":["DEBIAN-CVE-2015-8628","EUVD-2015-8505","GHSA-p4wx-g6w3-77pq","MGASA-2015-0486","UBUNTU-CVE-2015-8628"],"status":"published","title":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads,...","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01409,"percentile":0.72811,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-12-24T11:08:20Z","modified":"2026-09-09T07:02:02Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.25.5-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.25.5-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.12-1.mga5"}]}],"bundled":7}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Release Notes","Vendor Advisory","advisory","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/23/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"https://phabricator.wikimedia.org/T109724","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/21/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8628"},{"url":"https://github.com/advisories/GHSA-p4wx-g6w3-77pq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8628","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0486.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17379","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/12/23/7","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8628","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8628","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8628","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2017-03-23T20:00:00Z","modified":"2024-08-06T08:20:43.576Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8505","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2017-03-23T20:00:00Z","modified":"2024-08-06T08:20:43Z","updated_at":"2026-11-03T01:57:26.810911Z"}],"ghsa":[{"id":"GHSA-p4wx-g6w3-77pq","title":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads,...","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2022-05-17T02:53:20Z","modified":"2023-01-27T05:06:20Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:42:53.481756Z"}],"nvd":[{"id":"CVE-2015-8628","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2017-03-23T20:59:00.687Z","modified":"2026-06-17T00:34:52.983Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"CVE-2015-8628","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2017-03-23T20:59:00Z","modified":"2026-04-16T06:23:48.891942642Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8628","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"published","published":"2017-03-23T20:59:00.687Z","modified":"2026-09-09T07:02:02.026162358Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8628","description":"The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.","status":"withdrawn","published":"2017-03-23T20:59:00Z","modified":"2025-07-16T07:33:35.279478Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"MGASA-2015-0486","title":"Updated mediawiki packages fix security vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.12, an XSS vector exists when MediaWiki is\nconfigured with a non-standard configuration, from wikitext when\n$wgArticlePath='$1' (CVE-2015-8622).\n\nIn MediaWiki before 1.23.12, tokens were being compared as strings, which\ncould allow a timing attack (CVE-2015-8623, CVE-2015-8624).\n\nIn MediaWiki before 1.23.12, parameters passed to the curl library were not\nsanitized, which could cause curl to upload files from the webserver to an\nattacker when POST variable starts with '@' (CVE-2015-8625).\n\nIn MediaWiki before 1.23.12, the password reset token could be shorter than\nthe minimum required password length (CVE-2015-8626).\n\nIn MediaWiki before 1.23.12, blocking IP addresses with zero-padded octets\nresulted in a failure to block the IP address (CVE-2015-8627).\n\nIn MediaWiki before 1.23.12, a combination of Special:MyPage redirects and\npagecounts allows an external site to know the wikipedia login of an user\n(CVE-2015-8628).\n","status":"published","published":"2015-12-24T11:08:20Z","modified":"2026-04-16T06:25:46.182772267Z","updated_at":"2026-11-02T15:49:39.792687Z"}]}}