PT-2023-18788 · Mediawiki+1 · Growthexperiments+1

Urbanecm_Wmf · Publicado 2023-01-11 · Atualizado 2025-04-07 · CVE-2023-22945

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GrowthExperiments extension for MediaWiki versions 1.39 and earlier

Description The issue allows blocked users to enroll as mentors or edit their mentorship-related properties through the "growthmanagementorlist" API endpoint. This affects users blocked in ApiManageMentorList.

Recommendations For versions 1.39 and earlier, as a temporary workaround, consider disabling the growthmanagementorlist API endpoint until a patch is available. Restrict access to the ApiManageMentorList to minimize the risk of exploitation. Avoid using the growthmanagementorlist API endpoint until the issue is resolved.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-22945

CVE-2023-22945

Produtos afetados

Alt Linux

Growthexperiments

Referências · 111

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-1228 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39193 · Nota de Segurança
• https://phabricator.wikimedia.org/T307278 · Nota
• https://phabricator.wikimedia.org/T306741 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Nota de Segurança