CVE-2023-45364

MEDIUM

Mediawiki < 1.39.5 - Incorrect Permission Assignment

Title source: rule

Description

An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory

https://phabricator.wikimedia.org/T264765

Third Party Advisory vendor-advisory

https://www.debian.org/security/2023/dsa-5520

Scores

CVSS v3 5.3

EPSS 0.0012

EPSS Percentile 30.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-732

Status published

Products (4)

debian/debian_linux 11.0

debian/debian_linux 12.0

mediawiki/mediawiki 1.40.0

mediawiki/mediawiki 1.36.0 - 1.39.5

Published Oct 09, 2023

Tracked Since Feb 18, 2026