CVE-2023-29141
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
CVE-2023-29141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
CVE List
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
CVE-2023-29141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2023-0887
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
EUVD-2023-0887- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5vj8-g3qg-4qh6
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
GHSA-5vj8-g3qg-4qh6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
CVE-2023-29141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-29141
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
DEBIAN-CVE-2023-29141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5vj8-g3qg-4qh6
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
GHSA-5vj8-g3qg-4qh6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-29141
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
UBUNTU-CVE-2023-29141- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVBIT-mediawiki-2023-29141 No score
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
- Record
BIT-mediawiki-2023-29141- Updated
- 2026-11-02
OSVMGASA-2023-0204 No score
Updated mediawiki packages fix security vulnerability
Bundled PapaParse copy in VisualEditor has known ReDos (CVE-2020-36649).
An issue was discovered in MediaWiki before 1.35.9. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data (CVE-2022-47927).
An issue was discovered in MediaWiki before 1.35.9. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow (CVE-2023-22909).
An issue was discovered in MediaWiki before 1.35.9. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context (CVE-2023-22911).
An issue was discovered in MediaWiki before 1.35.10. An auto-block can occur for an untrusted X-Forwarded-For header (CVE-2023-29141).
OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration (T330086).
- Record
MGASA-2023-0204- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.39.0 up to 1.39.3 | 1.39.3 |
mediawiki/corePackagist |
1.38.0 up to 1.38.6 | 1.38.6 |
mediawiki/corePackagist |
before 1.35.10 | 1.35.10 |
mediawikiBitnami |
before 1.35.10, 1.36.0 up to 1.38.6, 1.39.0 up to 1.39.3 | 1.35.101.38.61.39.3 |
mediawikiDebian:12 |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
mediawikiDebian:13 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:14 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:10 |
before 1:1.31.16-1+deb10u6, plus listed versions 1:1.31.10-1~deb10u11:1.31.12-1~deb10u11:1.31.14-1~deb10u11:1.31.16-1+deb10u21:1.31.16-1+deb10u3 Show 14 moreShow less1:1.31.16-1+deb10u41:1.31.16-1+deb10u51:1.31.16-1~deb10u11:1.31.2-11:1.31.4-11:1.31.4-1~deb10u11:1.31.5-11:1.31.5-21:1.31.5-31:1.31.6-11:1.31.6-1~deb10u11:1.31.7-11:1.31.7-1~deb10u11:1.31.8-1 |
1:1.31.16-1+deb10u6 |
mediawikiDebian:11 From an advisory covering 3 CVEs |
before 1:1.35.11-1~deb11u1, plus listed versions 1:1.35.2-11:1.35.3-11:1.35.4-11:1.35.4-1+deb11u21:1.35.4-1~deb11u1 Show 7 moreShow less1:1.35.5-11:1.35.5-21:1.35.6-11:1.35.7-11:1.35.8-11:1.35.8-1.11:1.35.8-1~deb11u1 |
1:1.35.11-1~deb11u1 |
mediawikiDebian:12 From an advisory covering 3 CVEs |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.39.0 up to 1.39.3, plus listed versions 1.39.11.39.2 |
1.39.3 |
mediawiki/corePackagist |
1.38.0 up to 1.38.6, plus listed versions 1.38.11.38.21.38.31.38.41.38.5 |
1.38.6 |
mediawiki/corePackagist |
before 1.35.10, plus listed versions 1.20.31.20.41.20.51.20.61.20.7 Show 45 moreShow less1.20.81.21.01.21.11.21.101.21.111.21.21.21.31.21.41.21.51.21.61.21.71.21.81.21.91.22.0rc01.24.01.24.0-rc.01.24.0-rc.11.24.0-rc.21.24.0-rc.31.24.11.24.21.24.31.24.41.24.51.24.61.25.01.25.0-rc.01.25.11.25.21.25.31.25.41.25.51.25.61.26.01.26.11.26.21.26.31.26.41.27.01.27.0-rc.01.27.0-rc.11.27.11.27.21.27.31.27.4 |
1.35.10 |
mediawikiMageia:8 From an advisory covering 5 CVEs |
before 1.35.10-1.mga8 | 1.35.10-1.mga8 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:25.10 |
All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 |
None known |
mediawikiUbuntu:26.10 |
All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29141 is a critical vulnerability (CVSS 9.8) in Mediawiki, published March 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in mediawiki/core 1.39.3.
References
phabricator.wikimedia.org/T285159
gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.39
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR7
debian.org/security/2023/dsa-5447
lists.debian.org/debian-lts-announce/2023/08/msg00029.html
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-29141
mediawiki.org/wiki/Release_notes/1.35
github.com/advisories/GHSA-5vj8-g3qg-4qh6
security-tracker.debian.org/tracker/CVE-2023-29141
advisories.mageia.org/MGASA-2023-0204.html
bugs.mageia.org/show_bug.cgi?id=31463
lists.wikimedia.org/hyperkitty/list/[email protected]/message/UEMW64LVEH3BEXCJV43CVS6XPYURKWU3
ubuntu.com/security/CVE-2023-29141
cve.org/CVERecord?id=CVE-2023-29141
Left out here: 76 versions. The JSON record has them.