Unrated
An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi...
CVE-2023-45362
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-45362 mediawiki Fixed in: 1:1.35.13-1~deb11u1
- Ubuntu UBUNTU-CVE-2023-45362 mediawiki
Original description The description as published by the source.
An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.
References
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- web lists.fedoraproject.org
- web phabricator.wikimedia.org
- web lists.debian.org