CVE-2015-8007
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
09/11/2015
Last modified:
12/04/2025
Description
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification.
Impact
Base Score 2.0
4.00
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:echo_project:echo:*:*:*:*:*:mediawiki:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.securitytracker.com/id/1034028
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.html
- https://phabricator.wikimedia.org/T110553
- http://www.securitytracker.com/id/1034028
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000182.html
- https://phabricator.wikimedia.org/T110553