BIT-mediawiki-2023-45370

vendorUSosv

view advisory published 2024-03-06Licence: per source

An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-45370US	medium5.3OT elevated	0.38% (32nd)	—	2023-10-09
An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManager…

references

External citations — patches, advisories, analysis.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SportsTeams/+/959699/WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-45370WEB
https://phabricator.wikimedia.org/T345680WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan