CVE-2023-45371

HIGH

MediaWiki Wikibase Extension Resource Allocation Flaw

Title source: llm

Description

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.

References (2)

Core 2

Core References

Issue Tracking, Vendor Advisory

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264

Issue Tracking, Permissions Required

https://phabricator.wikimedia.org/T345064

Scores

CVSS v3 7.5

EPSS 0.0018

EPSS Percentile 39.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-770

Status published

Products (2)

mediawiki/mediawiki 1.40.0

mediawiki/mediawiki < 1.35.12

Published Oct 09, 2023

Tracked Since Feb 18, 2026