CVE-2022-41767

Published: Dec 26, 2022Modified: Apr 14, 2025

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.

Affected (3)

Products: Mediawiki: Mediawiki

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Before 1.35.8
Mediawiki Mediawiki	From 1.36.0 to 1.37.5
Mediawiki Mediawiki	From 1.38.0 to 1.38.3

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://phabricator.wikimedia.org/T316304

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://security.gentoo.org/glsa/202305-24

Source: cve@mitre.org

https://phabricator.wikimedia.org/T316304

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://security.gentoo.org/glsa/202305-24

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.