Lucene search

GoogleOSV:BIT-MEDIAWIKI-2023-45369

HistoryMar 06, 2024 - 10:58 a.m.

BIT-mediawiki-2023-45369

2024-03-0610:58:16

Google

osv.dev

pagetriage

extension

vulnerability

exposed

hidden usernames

mediawiki

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.

CPENameOperatorVersion
mediawikilt1.35.12
mediawikige1.40.0
mediawikilt1.39.5
mediawikile1.40.0
mediawikige1.36.0

Name	Operator	Version
mediawiki	lt	1.35.12
mediawiki	ge	1.40.0
mediawiki	lt	1.39.5
mediawiki	le	1.40.0
mediawiki	ge	1.36.0

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/PageTriage/+/960676

phabricator.wikimedia.org/T344359

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.0%

JSON

Related for OSV:BIT-MEDIAWIKI-2023-45369