CVE-2023-37300

MEDIUM

MediaWiki < 1.39.3 - Incorrect Authorization in CheckUserLog API

Title source: llm
STIX 2.1

Description

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.

References (2)

Core 2

Scores

CVSS v3 5.3
EPSS 0.0026
EPSS Percentile 49.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
mediawiki/mediawiki < 1.39.3
Published Jun 30, 2023
Tracked Since Feb 18, 2026