1. Home
  2. CVE Database
  3. CVE-2011-1766
MEDIUM · 5.8

CVE-2011-1766

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypas...

Vulnerability Description

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.

CVSS Score

5.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
MediawikiMediawiki<= 1.16.4

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2011-1766?

CVE-2011-1766 is a vulnerability with a CVSS score of 5.8 (MEDIUM). includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypas...

How severe is CVE-2011-1766?

CVE-2011-1766 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2011-1766?

Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki.