Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-1766 | First vendor Publication | 2011-05-23 |
| Vendor | Cve | Last vendor Modification | 2011-06-16 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5.8 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1766 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-09 (MediaWiki) File : nvt/glsa_201206_09.nasl |
| 2011-05-23 | Name : Fedora Update for mediawiki FEDORA-2011-6774 File : nvt/gb_fedora_2011_6774_mediawiki_fc14.nasl |
| 2011-05-23 | Name : Fedora Update for mediawiki FEDORA-2011-6775 File : nvt/gb_fedora_2011_6775_mediawiki_fc13.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 74613 | MediaWiki wgBlockDisablesLogin includes/User.php Auth Token Cached Data Multi... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-06-22 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-09.nasl - Type : ACT_GATHER_INFO |
| 2011-05-23 | Name : The remote Fedora host is missing a security update. File : fedora_2011-6774.nasl - Type : ACT_GATHER_INFO |
| 2011-05-23 | Name : The remote Fedora host is missing a security update. File : fedora_2011-6775.nasl - Type : ACT_GATHER_INFO |
| 2011-05-19 | Name : The remote Fedora host is missing a security update. File : fedora_2011-6781.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2021-05-04 12:14:25 |
|
| 2021-04-22 01:15:40 |
|
| 2020-05-24 01:07:45 |
|
| 2020-05-23 01:44:25 |
|
| 2020-05-23 00:28:25 |
|
| 2018-10-23 12:03:19 |
|
| 2016-04-26 20:44:00 |
|
| 2014-02-17 11:02:06 |
|
| 2013-05-10 22:59:41 |
|
