VulnerabilityModified
CVE-2023-45372
An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.
MEDIUM 5.3EPSS 0.34%
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-693
- Affected
- mediawiki/mediawiki
- Source
- cve@mitre.org
References
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264Issue Tracking, Vendor Advisory
- https://phabricator.wikimedia.org/T345064Issue Tracking, Permissions Required
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264Issue Tracking, Vendor Advisory
- https://phabricator.wikimedia.org/T345064Issue Tracking, Permissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.