Vulnerability Description
An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | >= 1.36.0, < 1.39.5 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://phabricator.wikimedia.org/T264765Issue TrackingVendor Advisory
- https://www.debian.org/security/2023/dsa-5520Third Party Advisory
- https://phabricator.wikimedia.org/T264765Issue TrackingVendor Advisory
- https://www.debian.org/security/2023/dsa-5520Third Party Advisory
FAQ
What is CVE-2023-45364?
CVE-2023-45364 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being ...
How severe is CVE-2023-45364?
CVE-2023-45364 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-45364?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki, Debian Debian Linux.