CVE-2023-37300
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through...
CVE-2023-37300 is a medium vulnerability (CVSS 5.3) in Mediawiki, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in mediawiki 1.39.4.
- Severity
- 5.3 MediumCVSS 3.1, NVD
- Exploit chance
- 0.67%EPSS, 52nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.39.4mediawiki +7 more
Description
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiBitnami | before 1.39.4 | 1.39.4 |
mediawikiUbuntu:18.04:LTS | All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 | None known |
mediawikiUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:Pro:22.04:LTS | All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:Pro:24.04:LTS | All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1 | None known |
mediawikiUbuntu:25.10 | All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 | None known |
mediawikiUbuntu:26.10 | All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 | None known |
mediawikiUbuntu:26.04:LTS | All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2 | None known |
What each source reports
NVD Score used
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
CVE-2023-37300- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
CVE-2023-37300- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2023-41205No score
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
EUVD-2023-41205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7jff-vjgp-2fjv
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through...
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
GHSA-7jff-vjgp-2fjv- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-37300
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
UBUNTU-CVE-2023-37300- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-mediawiki-2023-37300No score
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
BIT-mediawiki-2023-37300- Updated
- 2026-11-02
OSVNo score
An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.
- Record
CVE-2023-37300- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
phabricator.wikimedia.org/T330968
gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0a
nvd.nist.gov/vuln/detail/CVE-2023-37300
github.com/advisories/GHSA-7jff-vjgp-2fjv
ubuntu.com/security/CVE-2023-37300
cve.org/CVERecord?id=CVE-2023-37300