Description

An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)

Remediation

References

CVE-2024-40598

Related Vulnerabilities

WordPress Plugin Chat-Support Board-WordPress Chat Cross-Site Scripting (1.2.8)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3543)

WordPress Plugin EWWW Image Optimizer Cloud Cross-Site Scripting (2.0.1)

Contao Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5478)

WordPress Plugin Save Contact Form 7 Information Disclosure (2.0)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-532 CVE-2024-40598