Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).

Published

2023-10-09T06:15:10.607

Last Modified

2024-11-21T08:26:50.447

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

Weaknesses

Type: Primary
NVD-CWE-noinfo
Type: Secondary
CWE-693

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mediawiki	mediawiki	< 1.35.12	Yes
Application	mediawiki	mediawiki	< 1.39.5	Yes
Application	mediawiki	mediawiki	1.40.0	Yes

References

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264 Issue Tracking, Vendor Advisory ([email protected])
https://phabricator.wikimedia.org/T345064 Issue Tracking, Permissions Required ([email protected])
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://phabricator.wikimedia.org/T345064 Issue Tracking, Permissions Required (af854a3a-2127-422b-91ae-364da2661108)