CVE-2023-22912

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.9 MediaWiki versions 1.36.x through 1.38.x before 1.38.5 MediaWiki versions 1.39.x before 1.39.1

Description An issue was discovered in MediaWiki where the CheckUser TokenManager insecurely uses AES-CTR encryption with a repeated nonce, allowing an adversary to decrypt.

Recommendations For versions prior to 1.35.9, update to version 1.35.9 or later. For versions 1.36.x through 1.38.x before 1.38.5, update to version 1.38.5 or later. For versions 1.39.x before 1.39.1, update to version 1.39.1 or later.