CVE-2015-8007 The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demons...
MediumCVSS 4.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| echo project echo | All versions | No fix listed |
References
- 1034028 vdb-entry
- [MediaWiki-announce] 20151016 Extension Security Release: OAuth, Echo, PageTriage mailing-list patch vendor-advisory
- phabricator.wikimedia.org vendor-advisory