CVE-2016-6332

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.

• CWE-200

• https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T129738Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1369613Issue Tracking
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195.htmlMailing List, Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T129738Patch, Third Party Advisory

Published

Apr 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6326Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6327drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel be…
• CVE-2016-6328A vulnerability was found in libexif. An integer overflow wh…8.1
• CVE-2016-6329OpenVPN, when using a 64-bit block cipher, makes it easier f…
• CVE-2016-6330The server in Red Hat JBoss Operations Network (JON), when S…
• CVE-2016-6331ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, …
• CVE-2016-6333Cross-site scripting (XSS) vulnerability in the CSS user sub…
• CVE-2016-6334Cross-site scripting (XSS) vulnerability in the Parser::repl…
• CVE-2016-6335MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x b…
• CVE-2016-6336MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x b…
• CVE-2016-6337MediaWiki 1.27.x before 1.27.1 might allow remote attackers …
• CVE-2016-6338ovirt-engine-webadmin, as used in Red Hat Enterprise Virtual…