PT-2023-22165 · Mediawiki+1 · Growthexperiments+1

Kosta Harlan + 1 · CVE-2023-29137 · Published 2023-03-31 · Updated 2024-08-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GrowthExperiments extension for MediaWiki versions through 1.39.3

Description An issue in the GrowthExperiments extension for MediaWiki allows the UserImpactHandler to inadvertently return the timezone preference for arbitrary users. This can be used to de-anonymize users.

Recommendations For versions through 1.39.3, consider disabling the UserImpactHandler for GrowthExperiments until a patch is available to prevent the potential de-anonymization of users.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-29137

CVE-2023-29137

Affected Products

Alt Linux

Growthexperiments

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29137.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-29137 · Vendor Advisory
• https://phabricator.wikimedia.org/T328643 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29137 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2023-29137 · Vendor Advisory
• https://t.me/cvenotify/47900 · Telegram Post
• https://t.me/cibsecurity/61273 · Telegram Post