CVE-2023-29140

EPSS 0.07%
Published 31.03.2023 19:15:07
Last modified 18.02.2025 16:15:15
Source cve@mitre.org
Teams watchlist Login
Open Login

An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Mediawiki ≫ Mediawiki Version <= 1.39.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.07%	0.233

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://phabricator.wikimedia.org/T327613

Patch

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2023-29140

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-29140

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-29140

EUVD