https://bugzilla.wikimedia.org/show_bug.cgi?id=19010
Summary: It is possible to make brute force login attack to not
global account
Product: MediaWiki extensions
Version: any
Platform: All
OS/Version: All
Status: NEW
Severity: major
Priority: Normal
Component: CentralAuth
AssignedTo: [email protected]
ReportedBy: [email protected]
This is a security risk for old (not used for now) administrator accounts!
An attack schema on an not global account called "nnn" on the wiki "iii":
1) I create an account called "nnn" at several wikis
2) I convert an account "nnn" to global account
3) I tries to join the "nnn" in the wiki "iii" to my global account - no
restrictions on the number of unsuccessful attempts, no captcha
--
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
