CVE-2010-2787
Summary
| CVE | CVE-2010-2787 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-04-27 00:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:M/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mediawiki | Mediawiki | 1.1.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.10.0 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.10.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.10.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.11.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.11.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.11.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.12.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.12.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | rc1 | All | All |
| Application | Mediawiki | Mediawiki | 1.13.0 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.13.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.13.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.14.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.15.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.2.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.10 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.11 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.12 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.13 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.14 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.15 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.7 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.8 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.3.9 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta1 | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta2 | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta3 | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta4 | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta5 | All | All |
| Application | Mediawiki | Mediawiki | 1.4 | beta6 | All | All |
| Application | Mediawiki | Mediawiki | 1.4.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.10 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.11 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.12 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.13 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.14 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.7 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.8 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.4.9 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | alpha1 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | alpha2 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | beta1 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | beta2 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | beta3 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | beta4 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | rc2 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | rc3 | All | All |
| Application | Mediawiki | Mediawiki | 1.5 | rc4 | All | All |
| Application | Mediawiki | Mediawiki | 1.5.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.7 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.5.8 | All | All | All |
| Application | Mediawiki | Mediawiki | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Re: CVE request: mediawiki | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Patch |
| [SECURITY] Fedora 14 Update: mediawiki-1.16.4-58.fc14 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Subversion · rSVN | af854a3a-2127-422b-91ae-364da2661108 | svn.wikimedia.org | Patch |
| [SECURITY] Fedora 15 Update: mediawiki-1.16.4-58.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 15 Update: mediawiki-1.16.4-57.fc15 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | Patch |
| Bug 24565 – API public cache header vulnerability | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.wikimedia.org | |
| [SECURITY] Fedora 13 Update: mediawiki-1.16.4-58.fc13 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| MediaWiki 'api.php' Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Patch |
| 620224 – (CVE-2010-2787) CVE-2010-2787 MediaWiki (< v1.15.5, v1.16.0): Private data leakage via public caching headers | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| 620226 – CVE-2010-2787 CVE-2010-2788 mediawiki various flaws [fedora-all] | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| [MediaWiki-announce] MediaWiki security release: 1.16.0 and 1.15.5 | af854a3a-2127-422b-91ae-364da2661108 | lists.wikimedia.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.