{"id":"CVE-2023-45372","aliases":["BIT-mediawiki-2023-45372","EUVD-2023-49664","GHSA-2r79-m38c-p4mw"],"status":"published","title":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1...","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00403,"percentile":0.34845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2023-10-09T00:00:00Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.35.12","1.39.5","1.40.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.12"},{"introduced":"1.36.0"},{"fixed":"1.39.5"},{"introduced":"1.40.0"},{"fixed":"1.40.1"}]}]}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T345064","tags":["x_transferred","Issue Tracking","Permissions Required","web"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/961264","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45372","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2r79-m38c-p4mw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45372.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45372","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2023-10-09T00:00:00Z","modified":"2024-09-19T17:50:13.935Z","cwes":["CWE-693"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49664","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2023-10-09T00:00:00Z","modified":"2024-09-19T17:50:13Z","updated_at":"2026-11-03T00:28:18.665654Z"}],"ghsa":[{"id":"GHSA-2r79-m38c-p4mw","title":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1...","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2023-10-09T06:30:19Z","modified":"2024-09-19T21:33:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:58:18.610136Z"}],"nvd":[{"id":"CVE-2023-45372","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2023-10-09T06:15:10.607Z","modified":"2026-06-17T06:28:42.853Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:08:36.656095Z"}],"osv":[{"id":"BIT-mediawiki-2023-45372","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2024-03-06T10:57:42.805Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"CVE-2023-45372","description":"An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).","status":"published","published":"2023-10-09T00:00:00Z","modified":"2026-10-28T02:31:09.559573002Z","updated_at":"2026-11-02T15:44:34.287121Z"}]}}