Description

An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.

Remediation

References

CVE-2023-45362

Related Vulnerabilities

XWiki Transmission of Private Resources into a New Sphere ('Resource Leak') Vulnerability (CVE-2023-38509)

WordPress Plugin 10Web Social Feed for Instagram Security Bypass (1.3.18)

WordPress Plugin Web Forms for Vtiger wordpress Lead capture and Contacts Sync Unspecified Vulnerability (1.0.0)

WordPress Plugin Export any WordPress data to XML/CSV Arbitrary File Upload (0.9)

Apache HTTP Server Resource Management Errors Vulnerability (CVE-2007-6750)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CVE-2023-45362