GitHub Advisoryadvisory · Packagist

GHSA-5vj8-g3qg-4qh6 X-Forwarded-For header allows brute-forcing autoblocked IP addresses

CRITICAL Published 2023-03-31 Modified 2024-11-01 Official page ↗
Aliases
CVE-2023-29141
Ecosystem
Packagist
Packages
mediawiki/core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-444
Reviewed
2024-11-01

Affected packages

• Packagist mediawiki/core: >= 1.39.0, < 1.39.3 → fixed in 1.39.3 • Packagist mediawiki/core: >= 1.38.0, < 1.38.6 → fixed in 1.38.6 • Packagist mediawiki/core: < 1.35.10 → fixed in 1.35.10

Description

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

Related

Alias · CVE (1)

  • CVE-2023-29141 An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References