CVE-2023-22912

Published: Jan 20, 2023Modified: Apr 3, 2025

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated (aka re-used) nonce, allowing an adversary to decrypt.

Affected (5)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Before 1.35.9
Mediawiki Mediawiki	From 1.36.0 to 1.38.5
Mediawiki Mediawiki	Version 1.39.0
Mediawiki Mediawiki	Version 1.39.0 rc0
Mediawiki Mediawiki	Version 1.39.0 rc1

Related CWEs

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (2)

https://phabricator.wikimedia.org/T315123

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

https://phabricator.wikimedia.org/T315123

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchVendor Advisory

Timeline

No history available yet.