CVE-2023-29141
CRITICALMediaWiki <1.35.10, <1.36, <1.38.6, <1.39.3 - Info Disclosure
Title source: llmDescription
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
References (6)
Core 6
Core References
Release Notes
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.39
Issue Tracking, Permissions Required
https://phabricator.wikimedia.org/T285159
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5447
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR7/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONWHGOBFD6CQAEGOP5O375XAP2N6RUHT/
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/08/msg00029.html
Scores
CVSS v3
9.8
EPSS
0.0119
EPSS Percentile
63.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-444
Status
published
Products (3)
fedoraproject/fedora
37
mediawiki/core
1.39.0 - 1.39.3Packagist
mediawiki/mediawiki
< 1.35.10
Published
Mar 31, 2023
Tracked Since
Feb 18, 2026