PT-2023-18788 · Mediawiki+1 · Growthexperiments+1

Urbanecm_Wmf · Published 2023-01-11 · Updated 2025-04-07 · CVE-2023-22945

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GrowthExperiments extension for MediaWiki versions 1.39 and earlier

Description The issue allows blocked users to enroll as mentors or edit their mentorship-related properties through the "growthmanagementorlist" API endpoint. This affects users blocked in ApiManageMentorList.

Recommendations For versions 1.39 and earlier, as a temporary workaround, consider disabling the growthmanagementorlist API endpoint until a patch is available. Restrict access to the ApiManageMentorList to minimize the risk of exploitation. Avoid using the growthmanagementorlist API endpoint until the issue is resolved.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-22945

CVE-2023-22945

Affected Products

Alt Linux

Growthexperiments

References · 111

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Security Note
• https://bdu.fstec.ru/vul/2024-02749 · Security Note
• https://bdu.fstec.ru/vul/2024-02628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-1228 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39193 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Security Note
• https://bdu.fstec.ru/vul/2024-02755 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2023-22945 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22945 · Security Note