CVE-2022-39193 Information disclosure in n/a
The CheckUser extension for MediaWiki improperly exposes private edit and log performer information to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39193?
CVE-2022-39193 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer of edits and logged actions. This information should not allow public viewing: it is supposed to be viewable only by users with suppression rights.
Weakness: CWE-200
Which versions are affected by CVE-2022-39193?
1 open source package ship an affected version, including mediawiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | From 1.39.0 | 1.39.2 |
Products include Mediawiki Mediawiki.
How do I fix CVE-2022-39193?
Upgrade mediawiki to 1.39.2 or later.
Is CVE-2022-39193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39193 exists.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as BIT-mediawiki-2022-39193, GHSA-5jq2-gw2c-fg5h.