CVE-2023-37301

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T250720Exploit, Issue Tracking, Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933663Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T250720Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jun 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-373026.1An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This CVE-2023-373039.8An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails aft CVE-2023-373045.4An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignmen CVE-2023-373055.3An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandle CVE-2023-373067.5MISP 2.4.172 mishandles different certificate file extensions in server sync. An attacker can obtain sensitive information because of the na CVE-2023-373075.4In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.CVE-2023-373085.4Zoho ManageEngine ADAudit Plus before 7100 allows XSS via the username field.CVE-2023-37318.8Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a mal CVE-2023-373108.8D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows CVE-2023-373118.8D-Link DAP-2622 DDP Set Device Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows CVE-2023-373128.8D-Link DAP-2622 DDP Set Device Info Device Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows n CVE-2023-373138.8D-Link DAP-2622 DDP Set IPv4 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allow