Description
In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.
Remediation
References
Related Vulnerabilities
WordPress Plugin Thrive Apprentice Security Bypass (2.3.9.3)
WordPress 6.2.x Cross-Site Scripting (6.2 - 6.2.4)
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2021-39126)
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3481)
WordPress Plugin Developer Tools Arbitrary File Upload (1.1.4)