UpHeron
All vulnerabilities

Servers and applications

CVE-2023-45364

An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information.

Severity
Medium 5.3
Published
9 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
1.39.5
Sources
NVD

Affected software

SoftwareAffected versions
MediaWikiServers and applications · cpe:a:mediawiki:mediawiki
  • From 1.36.0 before 1.39.5
  • Version 1.40.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-45364
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-45364