What is GHSA-rmcp-9fhq-58pv?

GHSA-rmcp-9fhq-58pv is a security advisory published by GitHub Security Advisories with Medium severity. Improper permissions handling in MediaWiki AbuseFilter

Which CVE IDs does GHSA-rmcp-9fhq-58pv cover?

GHSA-rmcp-9fhq-58pv covers the following CVE IDs: CVE-2024-47913. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rmcp-9fhq-58pv?

GHSA-rmcp-9fhq-58pv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-rmcp-9fhq-58pv?

GHSA-rmcp-9fhq-58pv affects 3 products, including: composer/mediawiki/abuse-filter:\u003c 1.39.9; composer/mediawiki/abuse-filter:\u003e= 1.40.0, \u003c 1.41.3; composer/mediawiki/abuse-filter:\u003e= 1.42.0, \u003c 1.42.2.

GHSA-rmcp-9fhq-58pvMediumCVSS 5.3

Improper permissions handling in MediaWiki AbuseFilter

Vendor

GitHub Security Advisories

Published

October 5, 2024

Last Modified

December 6, 2024

🔗 CVE IDs covered (1)

CVE-2024-47913 →

📋 Description

An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

🎯 Affected products3

composer/mediawiki/abuse-filter:< 1.39.9
composer/mediawiki/abuse-filter:>= 1.40.0, < 1.41.3
composer/mediawiki/abuse-filter:>= 1.42.0, < 1.42.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-47913
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1076855
https://phabricator.wikimedia.org/T372998
https://github.com/advisories/GHSA-rmcp-9fhq-58pv