CVE-2015-8008

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.

• CWE-284

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.htmlIssue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170979.htmlIssue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171007.htmlIssue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/10/29/14Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/77379Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1034028Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1273353Issue Tracking, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.htmlIssue Tracking, Third Party Advisory
• https://phabricator.wikimedia.org/T103022Issue Tracking, Patch, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170961.htmlIssue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170979.htmlIssue Tracking, Third Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171007.htmlIssue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/10/29/14Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/77379Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1034028Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1273353Issue Tracking, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.htmlIssue Tracking, Third Party Advisory
• https://phabricator.wikimedia.org/T103022Issue Tracking, Patch, Third Party Advisory

Published

Dec 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8002The chunked upload API (ApiUpload) in MediaWiki before 1.23.…
• CVE-2015-8003MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x b…
• CVE-2015-8004MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x b…
• CVE-2015-8005MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x b…
• CVE-2015-8006Cross-site scripting (XSS) vulnerability in the PageTriage t…
• CVE-2015-8007The Echo extension for MediWiki does not properly implement …
• CVE-2015-8009The MWOAuthDataStore::lookup_token function in Extension:OAu…
• CVE-2015-8010Cross-site scripting (XSS) vulnerability in the Classic-UI w…
• CVE-2015-8011Buffer overflow in the lldp_decode function in daemon/protoc…9.8
• CVE-2015-8012lldpd before 0.8.0 allows remote attackers to cause a denial…7.5
• CVE-2015-8013s2k.js in OpenPGP.js will decrypt arbitrary messages regardl…
• CVE-2015-8019The skb_copy_and_csum_datagram_iovec function in net/core/da…