CVE-2023-37300
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
Risk Assessment
Incorrect access control may lead to the exposure of information about hidden users, posing a privacy risk.
Recommendation
It is recommended to update the CheckUser extension to the latest version to fix the access control issue.
Other vulnerabilities in CheckUser extension for MediaWiki
See all- CVE-2023-37303Critical
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3, where an attempt to block a user fails after a temporary browser hang, resulting in a DBQueryDisconnectedError error message.
- CVE-2023-37255Medium
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.
Original NVD description (English source)
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS