4.3

CVE-2023-45369

An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of hidden users are exposed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mediawiki ≫ Mediawiki Version < 1.35.12
Mediawiki ≫ Mediawiki Version >= 1.36.0 < 1.39.5
Mediawiki ≫ Mediawiki Version1.40.0 Update-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.296
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://phabricator.wikimedia.org/T344359
Vendor Advisory
Issue Tracking