CVE-2024-47913

MEDIUM5.3EPSS 0.69%

mediawiki - security update

Published: 10/5/2024Modified: 3/9/2026

Also known as:GHSA-rmcp-9fhq-58pv DSA-5785-1DEBIAN-CVE-2024-47913

Description

An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

Affected packages (3)

Debian/mediawikifrom 0, < 1:1.39.10-1~deb12u1
Debian/mediawikifrom 0, < 1:1.39.10-1~deb12u1
Packagist/mediawiki/abuse-filterfrom 0, < 1.39.9

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-47913
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2024-47913
PATCHhttps://github.com/wikimedia/mediawiki-extensions-AbuseFilter
WEBhttps://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1076855
WEBhttps://phabricator.wikimedia.org/T372998