CVE-2023-29140

EPSS 0.07%
Veröffentlicht 31.03.2023 19:15:07
Zuletzt bearbeitet 18.02.2025 16:15:15
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mediawiki ≫ Mediawiki Version <= 1.39.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.07%	0.233

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://phabricator.wikimedia.org/T327613

Patch

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2023-29140

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-29140

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-29140

EUVD