跳转到帖子

MediaWiki: Incorrect Authorization (CVE-2023-22945)

recommended_posts

发布于
  • Members

MediaWiki: Incorrect Authorization (CVE-2023-22945)

Severity
4
CVSS
(AV:N/AC:L/Au:S/C:N/I:P/A:N)
Published
01/11/2023
Created
01/20/2023
Added
01/20/2023
Modified
01/28/2025

Description

In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.

Solution(s)

  • mediawiki-upgrade-latest

References

  • https://attackerkb.com/topics/cve-2023-22945
  • CVE - 2023-22945
  • https://gerrit.wikimedia.org/r/q/Id1b83fcd58eccb8b2dfea44a3ab2f72314860d88
  • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AP65YEN762IBNQPOYGUVLTQIDLM5XD2A/
  • https://phabricator.wikimedia.org/T321733
  • 查看数 694
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…