CVE-2023-45374

MEDIUM

MediaWiki SportsTeams Extension CSRF in Special Pages

Title source: llm
STIX 2.1

Description

An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.

References (2)

Core 2
Core References
Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T345040

Scores

CVSS v3 5.3
EPSS 0.0008
EPSS Percentile 23.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
mediawiki/mediawiki 1.40.0
mediawiki/mediawiki < 1.35.12
Published Oct 09, 2023
Tracked Since Feb 18, 2026