Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

MediaWiki allows faster security‑code guessing via timing clues

CVE-2014-2243 · published 12 years ago
Summary

Versions of MediaWiki up to 1.22.2 stop checking a security code as soon as they find a wrong character. This lets an attacker measure how long the check takes and more quickly guess the correct code, potentially gaining unauthorized access. Upgrade MediaWiki to the latest release or apply the security patches that correct this timing behavior.

What to do
  • Update debian mediawiki to version 1:1.19.12+dfsg-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian mediawiki < 1:1.19.12+dfsg-1
Fix: upgrade to 1:1.19.12+dfsg-1
Debian:13 debian mediawiki < 1:1.19.12+dfsg-1
Fix: upgrade to 1:1.19.12+dfsg-1
Debian:14 debian mediawiki < 1:1.19.12+dfsg-1
Fix: upgrade to 1:1.19.12+dfsg-1
– mediawiki mediawiki <= 1.19.11
1.1.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.11
1.11.0
1.11.1
1.11.2
1.12.0
61 more version ranges
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Original advisory text
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which...
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
References
Severity
5.8 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-362Race Condition
Timeline
Published2 Mar 2014
Updated3 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-2243 · OSV
CVE-2014-2243 · NVD
Track software like this
Free during beta