CVE-2010-1150

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.15.3 MediaWiki version 1.6.x prior to 1.16.0beta2

Description The issue allows remote authenticated users to conduct phishing attacks. This is achieved by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue. The problem arises from the software not properly handling a correctly authenticated but unintended login attempt.

Recommendations For MediaWiki versions prior to 1.15.3, update to version 1.15.3 or later. For MediaWiki version 1.6.x prior to 1.16.0beta2, update to version 1.16.0beta2 or later.