PT-2023-8945 · Mediawiki+2 · Mediawiki Sportsteams Extension+2

Ashley · Publicado 2023-10-08 · Atualizado 2024-09-19 · CVE-2023-45374

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki SportsTeams extension versions 1.35.x through 1.35.11 MediaWiki SportsTeams extension versions 1.36.x through 1.39.4 MediaWiki SportsTeams extension versions 1.40.x through 1.40.0

Description An issue was discovered in the SportsTeams extension for MediaWiki. It does not check for the anti-CSRF edit token in "Special:SportsTeamsManager" and "Special:UpdateFavoriteTeams". This could allow a remote attacker to impact the integrity of protected information.

Recommendations For MediaWiki SportsTeams extension versions 1.35.x through 1.35.11, update to version 1.35.12 or later. For MediaWiki SportsTeams extension versions 1.36.x through 1.39.4, update to version 1.39.5 or later. For MediaWiki SportsTeams extension versions 1.40.x through 1.40.0, update to version 1.40.1 or later. As a temporary workaround, consider disabling access to "Special:SportsTeamsManager" and "Special:UpdateFavoriteTeams" until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2023-6419

ALT-PU-2024-11168

ALT-PU-2024-1228

BDU:2024-02747

BIT-MEDIAWIKI-2023-45374

CVE-2023-45374

Produtos afetados

Alt Linux

Mediawiki Sportsteams Extension

Red Os

Referências · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• https://phabricator.wikimedia.org/T345040 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45374 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-1228 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45374 · Aviso do Fabricante
• https://phabricator.wikimedia.org/T307278 · Nota