Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.

Published

2023-10-09T06:15:10.537

Last Modified

2024-11-21T08:26:50.297

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Primary
CWE-770

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mediawiki	mediawiki	< 1.35.12	Yes
Application	mediawiki	mediawiki	< 1.39.5	Yes
Application	mediawiki	mediawiki	1.40.0	Yes

References

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264 Issue Tracking, Vendor Advisory ([email protected])
https://phabricator.wikimedia.org/T345064 Issue Tracking, Permissions Required ([email protected])
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://phabricator.wikimedia.org/T345064 Issue Tracking, Permissions Required (af854a3a-2127-422b-91ae-364da2661108)