PT-2023-18772

CVE-2023-22912

Publicado

2023-01-20

Atualizado

2024-08-20

Descrição por

CVSS 3.1

5.3

Média

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.9 MediaWiki versions 1.36.x through 1.38.x before 1.38.5 MediaWiki versions 1.39.x before 1.39.1

Description An issue was discovered in MediaWiki where the CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated nonce, allowing an adversary to decrypt.

Recommendations For versions prior to 1.35.9, update to version 1.35.9 or later. For versions 1.36.x through 1.38.x before 1.38.5, update to version 1.38.5 or later. For versions 1.39.x before 1.39.1, update to version 1.39.1 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Bawolff

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-330: Use of Insufficiently Random Values

Identificadores relacionados

CVE-2023-22912