CVE-2023-22912 Weak cryptography in n/a
An attacker can decrypt CheckUser tokens due to insecure AES-CTR encryption with a reused nonce in MediaWiki.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22912?
CVE-2023-22912 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.
Weakness: CWE-330
Which versions are affected by CVE-2023-22912?
1 open source package ship an affected version, including mediawiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | All versions | 1.35.9, 1.38.5, 1.39.1 |
Products include Mediawiki Mediawiki.
How do I fix CVE-2023-22912?
Upgrade mediawiki to a fixed version for your release line: 1.35.9, 1.38.5 or 1.39.1.
Is CVE-2023-22912 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22912 exists.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as BIT-mediawiki-2023-22912, GHSA-x2pr-v49f-hmmm.