CVE-2023-45371

Published: Oct 9, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.

Affected (3)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Before 1.35.12
Mediawiki Mediawiki	From 1.36.0 to 1.39.5
Mediawiki Mediawiki	Version 1.40.0

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://phabricator.wikimedia.org/T345064

Source: cve@mitre.org

Issue TrackingPermissions Required

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://phabricator.wikimedia.org/T345064

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPermissions Required

Timeline

No history available yet.