Description

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).

Remediation

References

CVE-2023-45372

Related Vulnerabilities

WordPress Plugin Track That Stat 'data' Parameter Cross-Site Scripting (1.0.8)

Dolibarr Files or Directories Accessible to External Parties Vulnerability (CVE-2023-33568)

MySQL CVE-2015-4815 Vulnerability (CVE-2015-4815)

MySQL CVE-2018-3185 Vulnerability (CVE-2018-3185)

Django Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-33203)

Severity

Medium

Classification

CVE-2023-45372 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities