High WID-SEC-2023-2594 9 CVEs

MediaWiki: Mehre Schwachstellen

Published Oct 8, 2023 · Updated Nov 28, 2023 · Revision 3 · de-DE

Vendor: Debian Product: Linux Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 9

High 7.5

CVE-2023-45363 EPSS 24%

MediaWiki Denial of Service vulnerability

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected …

mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist

Oct 9, 2023
Unscored —

CVE-2023-45364

An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before…

mediawiki mediawiki Debian Ubuntu

Oct 9, 2023
Unscored —

CVE-2023-45367

An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, a…

Oct 9, 2023
Unscored —

CVE-2023-45369

An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, …

Oct 9, 2023
Unscored —

CVE-2023-45370

An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5,…

Oct 9, 2023
Unscored —

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, an…

Oct 9, 2023
Unscored —

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, an…

Oct 9, 2023
Unscored —

CVE-2023-45373

An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.…

Oct 9, 2023
Unscored —

CVE-2023-45374

An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5,…

Oct 9, 2023

Revision history

2023-11-28 #3
Neue Updates von Debian aufgenommen
2023-10-10 #2
Neue Updates von Debian aufgenommen
2023-10-08 #1
Initiale Fassung

References

Debian Security Advisory DLA-3671 vom 2023-11-28
https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
Debian Security Advisory DSA-5520 vom 2023-10-10
https://lists.debian.org/debian-security-announce/2023/msg00213.html
MediaWiki Security Notification vom 2023-10-08
https://github.com/advisories/GHSA-w5fx-cx7f-6vr9
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45374
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45371
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45370
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45369
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45364
CVE Database vom 2023-10-09
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45363