CVE-2019-15150 - In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function

Back Back to CVE browser

HIGH

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function

Published Aug 19, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.16%

Description

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (6)

http://packetstormsecurity.com/files/154140/MediaWiki-OAuth2-Client-0.3-Cross-Site-Request-Forgery.html
x_refsource_MISCThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Aug/25
mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/08/19/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/Schine/MW-OAuth2Client/commit/6a4fe4500ddd72ad4e826d9d63b2d69512bd10d1
x_refsource_CONFIRMPatch
https://github.com/Schine/MW-OAuth2Client/releases/tag/v0.4
x_refsource_CONFIRMRelease Notes
https://seclists.org/bugtraq/2019/Aug/32
mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/154140/MediaWiki-OAuth2-Client-0.3-Cross-Site-Request-Forgery.html		x_refsource_MISCThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Aug/25		mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/08/19/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/Schine/MW-OAuth2Client/commit/6a4fe4500ddd72ad4e826d9d63b2d69512bd10d1		x_refsource_CONFIRMPatch
https://github.com/Schine/MW-OAuth2Client/releases/tag/v0.4		x_refsource_CONFIRMRelease Notes
https://seclists.org/bugtraq/2019/Aug/32		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 19, 2019

Updated Aug 5, 2024

Reserved Aug 18, 2019

Link CVE-2019-15150

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-15150

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-15150