Improper Implementation of Hideuser Functionality in Echo Extension for MediWiki

CVE-2015-8007 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:N/A:N

The Echo extension for MediWiki does not properly implement the hideuser functionality, which allows remote authenticated users to see hidden usernames in "non-revision based" notifications, as demonstrated by viewing a hidden username in a Thanks notification.

Learn more about our User Device Pen Test.