PT-2023-25896 · Mediawiki+1 · Mediawiki Proofreadpage Extension+1

Soda · Publicado 2023-06-30 · Atualizado 2024-11-26 · CVE-2023-37305

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki ProofreadPage extension versions through 1.39.3

Description An issue in the ProofreadPage extension for MediaWiki allows hidden users to be exposed via public interfaces, specifically in the includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php files.

Recommendations For versions through 1.39.3, consider restricting access to the PageContentHandler and PageDisplayHandler classes until a patch is available. As a temporary workaround, review the configuration of public interfaces to minimize the exposure of hidden users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Enumeração de Fraquezas

CWE-203

Identificadores relacionados

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-37305

CVE-2023-37305

Produtos afetados

Alt Linux

Mediawiki Proofreadpage Extension

Referências · 108

• 🔥 https://phabricator.wikimedia.org/T326952 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-37305 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://gerrit.wikimedia.org/r/q/Ibe5f8e25dea155bbd811a65833394c0d4b906a34 · Aviso do Fabricante
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-1228 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39193 · Nota de Segurança