PT-2023-8945 · Mediawiki+2 · Mediawiki Sportsteams Extension+2

Ashley · Published 2023-10-08 · Updated 2024-09-19 · CVE-2023-45374

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki SportsTeams extension versions 1.35.x through 1.35.11 MediaWiki SportsTeams extension versions 1.36.x through 1.39.4 MediaWiki SportsTeams extension versions 1.40.x through 1.40.0

Description An issue was discovered in the SportsTeams extension for MediaWiki. It does not check for the anti-CSRF edit token in "Special:SportsTeamsManager" and "Special:UpdateFavoriteTeams". This could allow a remote attacker to impact the integrity of protected information.

Recommendations For MediaWiki SportsTeams extension versions 1.35.x through 1.35.11, update to version 1.35.12 or later. For MediaWiki SportsTeams extension versions 1.36.x through 1.39.4, update to version 1.39.5 or later. For MediaWiki SportsTeams extension versions 1.40.x through 1.40.0, update to version 1.40.1 or later. As a temporary workaround, consider disabling access to "Special:SportsTeamsManager" and "Special:UpdateFavoriteTeams" until a patch is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2023-6419

ALT-PU-2024-11168

ALT-PU-2024-1228

BDU:2024-02747

BIT-MEDIAWIKI-2023-45374

CVE-2023-45374

Affected Products

Alt Linux

Mediawiki Sportsteams Extension

Red Os

References · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Security Note
• https://phabricator.wikimedia.org/T345040 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Security Note
• https://bdu.fstec.ru/vul/2024-02749 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Security Note
• https://bdu.fstec.ru/vul/2024-02628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-1228 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45374 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Security Note
• https://bdu.fstec.ru/vul/2024-02755 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22945 · Security Note