Description
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the timezone preference for arbitrary users, which can be used to de-anonymize users.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-2465 Vulnerability (CVE-2013-2465)
WordPress Plugin Work The Flow File Upload Arbitrary File Upload (2.5.2)
Oracle JRE CVE-2012-0505 Vulnerability (CVE-2012-0505)
WordPress Plugin Yoast SEO Cross-Site Scripting (2.0.1)
WordPress Plugin WPeMatico RSS Feed Fetcher Cross-Site Scripting (2.3.7)