CVE-2014-2243: Mediawiki

Medium severity, CVSS 5.8. EPSS: 1.5% chance of exploitation in the next 30 days.

includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

Affected products

• Mediawiki Mediawiki: up to and including 1.19.11; version 1.1.0 only; version 1.10.0 only; version 1.10.1 only; version 1.10.2 only; version 1.10.3 only; …

Published 2014-03-02. Last modified 2026-06-17.