What’s Vulnerable › Vulnerabilities

CVE-2015-2940

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-04-13 · updated 2026-06-17
• Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in the CheckUser extension for MediaWiki allows remote attackers to hijack the authentication of certain users for requests that retrieve sensitive user information via unspecified vectors.

Affected products

• Wikimedia Foundation CheckUser: all versions

References

• http://www.mandriva.com/security/advisories?name=MDVSA-2015:200
• http://www.openwall.com/lists/oss-security/2015/04/01/1
• http://www.openwall.com/lists/oss-security/2015/04/07/3
• http://www.securityfocus.com/bid/73477
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html
• https://phabricator.wikimedia.org/T85858
• https://security.gentoo.org/glsa/201510-05
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:200
• http://www.openwall.com/lists/oss-security/2015/04/01/1
• http://www.openwall.com/lists/oss-security/2015/04/07/3
• http://www.securityfocus.com/bid/73477
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html

Get alerted when CVE-2015-2940 or the next vulnerability affects your stack