CVE-2023-37300

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hidden users.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0aVendor Advisory
https://phabricator.wikimedia.org/T330968Exploit, Patch, Vendor Advisory
https://gerrit.wikimedia.org/r/q/I993fdcae1fedb7dd543b35a477026bc727615b0aVendor Advisory
https://phabricator.wikimedia.org/T330968Exploit, Patch, Vendor Advisory

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-373015.3An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restor CVE-2023-373026.1An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This CVE-2023-373039.8An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails aft CVE-2023-373045.4An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignmen CVE-2023-373055.3An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandle CVE-2023-373067.5MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the na CVE-2023-373075.4In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.CVE-2023-373085.4Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.CVE-2023-37318.8Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a mal CVE-2023-373108.8D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows CVE-2023-373118.8D-Link DAP-2622 DDP Set Device Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows CVE-2023-373128.8D-Link DAP-2622 DDP Set Device Info Device Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows n