{"id":"GHSA-rmcp-9fhq-58pv","aliases":["CVE-2024-47913"],"title":"Improper permissions handling in MediaWiki AbuseFilter","description":"An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.","severity":"medium","score":5.3,"published":"2024-10-05T00:34:19.000Z","modified":"2024-12-06T22:27:27.355Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mediawiki/abuse-filter","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.39.9"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.39.9"]},{"ecosystem":"Packagist","name":"mediawiki/abuse-filter","ranges":[{"events":[{"introduced":"1.40.0"},{"fixed":"1.41.3"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.41.3"]},{"ecosystem":"Packagist","name":"mediawiki/abuse-filter","ranges":[{"events":[{"introduced":"1.42.0"},{"fixed":"1.42.2"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["1.42.2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-47913","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1076855","https://github.com/wikimedia/mediawiki-extensions-AbuseFilter","https://phabricator.wikimedia.org/T372998"],"sources":[{"name":"OSV","id":"GHSA-rmcp-9fhq-58pv","modified":"2024-12-06T22:27:27.355742Z","url":"https://osv.dev/vulnerability/GHSA-rmcp-9fhq-58pv"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}]}