Untriaged
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, …
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
Affected products
MediaWiki
- ==1.20.x before 1.20.8
- ==1.21.x before 1.21.3
- ==before 1.19.9
Package maintainers
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@gshipunov Grigory Shipunov <blame@oxapentane.com>
-
@tanneberger Tassilo Tanneberger <revol-xut@protonmail.com>
-
@astro Astro <astro@spaceboyz.net>