PT-2023-25894 · Mediawiki+1 · Mediawiki Checkuser Extension+1

Generalnotability · Publicado 2023-06-30 · Atualizado 2024-11-27 · CVE-2023-37303

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CheckUser extension for MediaWiki versions through 1.39.3

Description An issue was discovered in certain situations where an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.

Recommendations For CheckUser extension for MediaWiki versions through 1.39.3, update to a version later than 1.39.3 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this issue.

Exploit

Correção

Improper Check for Exceptional Conditions

Enumeração de Fraquezas

CWE-754

Identificadores relacionados

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-37303

CVE-2023-37303

Produtos afetados

Alt Linux

Mediawiki Checkuser Extension

Referências · 109

• 🔥 https://phabricator.wikimedia.org/T338276 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-37303 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-37303 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• https://gerrit.wikimedia.org/r/q/I10a9273c542576b3f7bb38de68dcd2aa41cfb1b0 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-37303 · Aviso do Fabricante