Wikibase Extension up to 1.35.11/1.39.4/1.40.0 on MediaWiki Merge

Summaryinfo

A vulnerability was found in Wikibase Extension up to 1.35.11/1.39.4/1.40.0 on MediaWiki. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component Merge Handler. This manipulation causes an unknown weakness. The identification of this vulnerability is CVE-2023-45372. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Wikibase Extension up to 1.35.11/1.39.4/1.40.0 on MediaWiki (Content Management System). It has been declared as problematic. Affected by this vulnerability is an unknown function of the component Merge Handler. As an impact it is known to affect integrity. The summary by CVE is:

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).

The weakness was shared 10/09/2023. The advisory is shared at gerrit.wikimedia.org. This vulnerability is known as CVE-2023-45372 since 10/09/2023. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.35.12, 1.39.5 or 1.40.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-49664). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• Wikibase Extension

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.35.0
• 1.35.1
• 1.35.2
• 1.35.3
• 1.35.4
• 1.35.5
• 1.35.6
• 1.35.7
• 1.35.8
• 1.35.9
• 1.35.10
• 1.35.11
• 1.36
• 1.37
• 1.38
• 1.39
• 1.39.0
• 1.39.1
• 1.39.2
• 1.39.3
• 1.39.4
• 1.40.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion