CVE-2023-37305 Information disclosure in n/a

What is CVE-2023-37305?

CVE-2023-37305 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/Page/PageDisplayHandler.php, hidden users can be exposed via public interfaces.

Weakness: CWE-203

Which versions are affected by CVE-2023-37305?

1 open source package ship an affected version, including mediawiki. It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2023-37305?

Upgrade mediawiki to 1.39.4 or later.

Is CVE-2023-37305 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37305 exists.

Other vulnerabilities in Mediawiki Mediawiki

• CVE-2023-37303 Denial of service in n/a Critical 9.8
• CVE-2022-29904 SQL injection in n/a Critical 9.8
• CVE-2022-29906 Missing authorization in n/a Critical 9.8
• CVE-2022-28205 Business logic in n/a Critical 9.8
• CVE-2022-28206 Missing authorization in n/a Critical 9.8

All Mediawiki Mediawiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mediawiki-2023-37305, GHSA-qpx9-w5wp-x7q5, UBUNTU-CVE-2023-37305.