GitHub Advisoryadvisory · Packagist

GHSA-rmcp-9fhq-58pv Improper permissions handling in MediaWiki AbuseFilter

MEDIUM Published 2024-10-05 Modified 2024-12-06 Official page ↗
Aliases
CVE-2024-47913
Ecosystem
Packagist
Packages
mediawiki/abuse-filter
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-12-06

Affected packages

• Packagist mediawiki/abuse-filter: < 1.39.9 → fixed in 1.39.9 • Packagist mediawiki/abuse-filter: >= 1.40.0, < 1.41.3 → fixed in 1.41.3 • Packagist mediawiki/abuse-filter: >= 1.42.0, < 1.42.2 → fixed in 1.42.2

Description

An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

Related

Alias · CVE (1)

  • CVE-2024-47913 An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References