CVE-2023-29140 in GrowthExperiments Extension
Summary
by MITRE • 03/31/2023
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been hidden, because there is no check for rev_deleted.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/08/2025
The vulnerability identified as CVE-2023-29140 resides within the GrowthExperiments extension for MediaWiki versions 1.39.3 and earlier, representing a critical access control flaw that undermines the privacy protections designed for user contributions. This issue specifically targets the handling of revision data where user identities have been intentionally obscured through the rev_deleted flag, which is a standard MediaWiki mechanism for marking edits as hidden from public view. The flaw allows malicious actors to bypass intended privacy controls and access sensitive edit information that should remain concealed due to user privacy preferences or administrative decisions.
The technical root cause of this vulnerability stems from the absence of proper validation checks within the GrowthExperiments extension's code implementation. When MediaWiki processes revisions with the rev_deleted flag set, it should prevent unauthorized access to the underlying edit data regardless of the extension being used. However, the GrowthExperiments extension fails to consult this crucial flag during its data retrieval operations, effectively creating a pathway for attackers to obtain information that has been explicitly marked as deleted or hidden. This represents a direct violation of the principle of least privilege and data confidentiality that should govern all access controls within content management systems.
The operational impact of this vulnerability extends beyond simple privacy concerns to potentially expose sensitive user activities and metadata that could be leveraged for targeted attacks or social engineering campaigns. When usernames are hidden through rev_deleted flags, it typically occurs for legitimate reasons such as protecting user privacy, preventing harassment, or maintaining administrative discretion over certain edits. The ability to bypass these protections means that attackers can access detailed contribution histories, identify users who have made specific edits, and potentially correlate this information with other publicly available data to build comprehensive profiles of users. This vulnerability directly impacts the integrity of user privacy controls and can compromise the trust users place in the platform's security measures.
Organizations utilizing MediaWiki with the GrowthExperiments extension should immediately implement mitigations to address this vulnerability, including upgrading to patched versions of MediaWiki 1.39.4 or later where this issue has been resolved. The fix typically involves implementing proper checks for the rev_deleted flag within the extension's data access methods to ensure that hidden revisions are not exposed to unauthorized users. Additionally, administrators should review their current access control policies and consider implementing additional monitoring for unusual access patterns that might indicate exploitation attempts. This vulnerability aligns with CWE-668 (Exposure of Resource to Wrong Sphere) and could be categorized under ATT&CK technique T1213.002 (Data from Information Repositories) when exploited for unauthorized data access. Security teams should also consider implementing automated scanning tools to identify any unauthorized access attempts to revision data that might indicate this vulnerability is being actively exploited in their environments.