GHSA-5vj8-g3qg-4qh6

Source

https://github.com/advisories/GHSA-5vj8-g3qg-4qh6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-5vj8-g3qg-4qh6/GHSA-5vj8-g3qg-4qh6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5vj8-g3qg-4qh6

Aliases

Published

2023-03-31T21:30:40Z

Modified

2025-02-18T23:11:36.635943Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

X-Forwarded-For header allows brute-forcing autoblocked IP addresses

Details

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

Database specific

{
    "nvd_published_at": "2023-03-31T19:15:00Z",
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-444"
    ],
    "github_reviewed_at": "2024-11-01T22:02:38Z",
    "github_reviewed": true
}

References

Affected packages

Packagist / mediawiki/core

Package

Name: mediawiki/core
Purl: pkg:composer/mediawiki/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.39.0

Fixed

1.39.3

Affected versions

1.*

1.39.0

1.39.1

1.39.2

Packagist / mediawiki/core

Package

Name: mediawiki/core
Purl: pkg:composer/mediawiki/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.38.0

Fixed

1.38.6

Affected versions

1.*

1.38.0

1.38.1

1.38.2

1.38.3

1.38.4

1.38.5

Packagist / mediawiki/core

Package

Name: mediawiki/core
Purl: pkg:composer/mediawiki/core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.35.10

Affected versions

1.*

1.20.3

1.20.4

1.20.5

1.20.6

1.20.7

1.20.8

1.21.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.5

1.21.6

1.21.7

1.21.8

1.21.9

1.21.10

1.21.11

1.22.0rc0

1.24.0-rc.0

1.24.0-rc.1

1.24.0-rc.2

1.24.0-rc.3

1.24.0

1.24.1

1.24.2

1.24.3

1.24.4

1.24.5

1.24.6

1.25.0-rc.0

1.25.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.25.6

1.26.0

1.26.1

1.26.2

1.26.3

1.26.4

1.27.0-rc.0

1.27.0-rc.1

1.27.0

1.27.1

1.27.2

1.27.3

1.27.4

1.27.5

1.27.6

1.27.7

1.28.0-rc.0

1.28.0-rc.1

1.28.0

1.28.1

1.28.2

1.28.3

1.29.0-rc.0

1.29.0-rc.1

1.29.0

1.29.1

1.29.2

1.29.3

1.30.0-rc.0

1.30.0

1.30.1

1.30.2

1.31.0-rc.0

1.31.0-rc.1

1.31.0-rc.2

1.31.0

1.31.1

1.31.2

1.31.3

1.31.4

1.31.5

1.31.6

1.31.7

1.31.8

1.31.9

1.31.10

1.31.11

1.31.12

1.31.13

1.31.14

1.31.15

1.31.16

1.32.0-rc.0

1.32.0-rc.1

1.32.0-rc.2

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.33.0-rc.0

1.33.0

1.33.1

1.33.2

1.33.3

1.33.4

1.34.0-rc.0

1.34.0-rc.1

1.34.0

1.34.1

1.34.2

1.34.3

1.34.4

1.35.0-rc.0

1.35.0-rc.1

1.35.0-rc.2

1.35.0-rc.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.35.9