{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-27T00:00:00", "descriptions": [{"lang": "en", "value": "includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a \"login CSRF\" issue."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-04-20T01:57:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=62497"}, {"name": "[oss-security] 20140327 CVE request: MediaWiki 1.22.5 login csrf", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2014/03/28/1"}, {"name": "[mediawiki-announce] 20140328 MediaWiki Security and Maintenance Releases: 1.22.5, 1.21.8 and 1.19.14", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html"}, {"name": "[oss-security] 20140401 Re: CVE request: MediaWiki 1.22.5 login csrf", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2014/04/01/7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-2665", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a \"login CSRF\" issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.wikimedia.org/show_bug.cgi?id=62497", "refsource": "CONFIRM", "url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=62497"}, {"name": "[oss-security] 20140327 CVE request: MediaWiki 1.22.5 login csrf", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2014/03/28/1"}, {"name": "[mediawiki-announce] 20140328 MediaWiki Security and Maintenance Releases: 1.22.5, 1.21.8 and 1.19.14", "refsource": "MLIST", "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html"}, {"name": "[oss-security] 20140401 Re: CVE request: MediaWiki 1.22.5 login csrf", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2014/04/01/7"}, {"name": "https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php", "refsource": "CONFIRM", "url": "https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-2665", "datePublished": "2014-04-20T01:00:00", "dateReserved": "2014-03-26T00:00:00", "dateUpdated": "2014-04-20T01:57:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB348567-4B1F-4E94-9511-46D6F7D37038", "versionEndIncluding": "1.19.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19:*:*:*:*:*:*:*", "matchCriteriaId": "93D7105D-3CF1-49FF-9F51-088C58F19003", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19:beta_1:*:*:*:*:*:*", "matchCriteriaId": "F647077F-52FD-460B-9511-85812A1447FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19:beta_2:*:*:*:*:*:*", "matchCriteriaId": "BB5A8AFF-EF0E-490C-8833-FF1071563979", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*", "matchCriteriaId": "A7C29D44-2964-483F-B672-27B5CE471DA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*", "matchCriteriaId": "172FEFE5-9900-49D0-9E14-2FA4A7912D23", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*", "matchCriteriaId": "CA3205F5-3A29-4D45-AC95-83174F8969BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*", "matchCriteriaId": "5547DA02-3BEC-4278-A714-25CCB820AA79", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*", "matchCriteriaId": "A3E5609D-EC04-4088-9B61-ABDD256200F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*", "matchCriteriaId": "B23B09BB-8F43-4D60-A37F-D8685584AF4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*", "matchCriteriaId": "9A8A3F38-9A86-4346-9337-5C2A1DED37C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*", "matchCriteriaId": "49CCC3B5-9BD4-40B4-AF1A-DF4B2A6DC12D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.8:*:*:*:*:*:*:*", "matchCriteriaId": "36DA1112-69AB-408A-886E-F248516FDE11", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.9:*:*:*:*:*:*:*", "matchCriteriaId": "DA85F3B7-9CB4-481C-B1A5-AB95F81C4126", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.10:*:*:*:*:*:*:*", "matchCriteriaId": "A25C57E2-8E04-4A54-9211-C7B4B7CC4E89", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.11:*:*:*:*:*:*:*", "matchCriteriaId": "927A7FCC-273B-4387-A9DB-C1DADB40D3FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.12:*:*:*:*:*:*:*", "matchCriteriaId": "37210D17-71E8-4A05-87CE-F27E2F8DDEF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20:*:*:*:*:*:*:*", "matchCriteriaId": "8FA45494-185A-4ED1-8818-D9F14EB9B59B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.1:*:*:*:*:*:*:*", "matchCriteriaId": "59319309-D926-4353-8E0C-1FE0CB97E4D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.2:*:*:*:*:*:*:*", "matchCriteriaId": "DA15B197-EC42-49F0-8764-E315CDA7EA03", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.3:*:*:*:*:*:*:*", "matchCriteriaId": "ECD4CD3D-6022-4F75-A524-5A5247EF23AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.4:*:*:*:*:*:*:*", "matchCriteriaId": "75B95AE3-6FA0-44BD-A78A-F059613B57EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.5:*:*:*:*:*:*:*", "matchCriteriaId": "94646567-FF30-4FBA-96C5-914EB3C85D7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.6:*:*:*:*:*:*:*", "matchCriteriaId": "AF088531-6875-49A2-B220-D7EC38ECC50F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.7:*:*:*:*:*:*:*", "matchCriteriaId": "902A7EE8-90AA-4B0D-9142-DFCDA5AC8914", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.20.8:*:*:*:*:*:*:*", "matchCriteriaId": "9B6CD057-EBC4-4909-9734-80577AFDED40", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21:*:*:*:*:*:*:*", "matchCriteriaId": "383CE1D8-7A58-4C24-8898-8C592F98EFCC", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*", "matchCriteriaId": "3DA12531-818E-4AD7-A3E7-467604775416", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:*", "matchCriteriaId": "1E87AB00-90DD-4548-B23A-42673DDFD1D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*", "matchCriteriaId": "01D8F235-2F1B-4198-A91E-B2723293AA36", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.4:*:*:*:*:*:*:*", "matchCriteriaId": "D2A5F4A7-40E7-42D0-8482-647D0EC54AC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.5:*:*:*:*:*:*:*", "matchCriteriaId": "E10A8FAC-7506-48B8-A4EE-B7A1BE20537E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.6:*:*:*:*:*:*:*", "matchCriteriaId": "1EF797B5-8348-481C-AB6F-154DEA0E5281", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.7:*:*:*:*:*:*:*", "matchCriteriaId": "6E627F80-E6AA-4627-B58E-D6B2A08269BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*", "matchCriteriaId": "DB117E2F-D4CD-4CED-BCEF-3C821A431F6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.1:*:*:*:*:*:*:*", "matchCriteriaId": "B461B44C-37D2-480B-9645-B7E8720416C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.2:*:*:*:*:*:*:*", "matchCriteriaId": "E491E3AD-0FB2-41CD-B852-CAFCA397A45A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.3:*:*:*:*:*:*:*", "matchCriteriaId": "CBD50108-A301-4B5B-9047-6FD6792442B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.4:*:*:*:*:*:*:*", "matchCriteriaId": "91BBFEC5-A933-4178-919D-9AC87CF76D21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a \"login CSRF\" issue."}, {"lang": "es", "value": "El archivo includes/specials/SpecialChangePassword.php en MediaWiki anterior a versiones 1.19.14, 1.20.x y versiones 1.21.x anterior a 1.21.8, y versiones 1.22.x anteriores a 1.22.5 no maneja apropiadamente un intento de inicio de sesi\u00f3n correctamente autenticado pero no previsto, lo que hace m\u00e1s f\u00e1cil para que los usuarios autenticados remotos obtengan informaci\u00f3n confidencial al hacer que una v\u00edctima inicie sesi\u00f3n en la cuenta del atacante, como es demostrado mediante el rastreo de la actividad de la v\u00edctima, relacionada con un problema de \"login CSRF\"."}], "id": "CVE-2014-2665", "lastModified": "2014-04-24T05:06:23.157", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-04-20T01:55:06.987", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-March/000145.html"}, {"source": "cve@mitre.org", "url": "http://openwall.com/lists/oss-security/2014/03/28/1"}, {"source": "cve@mitre.org", "url": "http://openwall.com/lists/oss-security/2014/04/01/7"}, {"source": "cve@mitre.org", "url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=62497"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/#/c/121517/1/includes/specials/SpecialChangePassword.php"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}