PT-2024-3288 · Wikimedia+2 · Mediawiki+2
Lucas Werkmeister
+1
·
Published
2024-02-09
·
Updated
2025-06-19
·
CVE-2024-34502
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MediaWiki versions 1.39.6 and earlier, 1.40.x versions prior to 1.40.2, 1.41.x versions prior to 1.41.1
Description
An issue was discovered in WikibaseLexeme, related to inadequate access control. This issue allows an attacker to make an edit that merges the from-id to the to-id when loading Special:MergeLexemes, even if the request was not a POST request and does not contain an edit token. The exploitation of this issue may allow a remote attacker to elevate their privileges.
Recommendations
For MediaWiki versions 1.39.6 and earlier, update to version 1.39.6 or later.
For MediaWiki 1.40.x versions prior to 1.40.2, update to version 1.40.2 or later.
For MediaWiki 1.41.x versions prior to 1.41.1, update to version 1.41.1 or later.
As a temporary workaround, consider restricting access to the Special:MergeLexemes page until a patch is available.
Fix
Improper Access Control
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Mediawiki
Red Os