CVE-2023-37303
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3, where an attempt to block a user fails after a temporary browser hang, resulting in a DBQueryDisconnectedError error message.
Risk Assessment
The organization may face difficulties in managing users, potentially leading to unauthorized access or abuse within the system.
Recommendation
It is recommended to update the CheckUser extension to the latest version to mitigate this vulnerability and to monitor logs for potential abuse.
Other vulnerabilities in CheckUser extension for MediaWiki
See all- CVE-2023-37300Medium
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- CVE-2023-37255Medium
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.
Original NVD description (English source)
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary browser hang and a DBQueryDisconnectedError error message.