Fluid Attacks Database

Description

X-Forwarded-For header allows brute-forcing autoblocked IP addresses An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	mediawiki/core	>=1.39.0 <1.39.3 \|\| >=1.38.0 <1.38.6 \|\| >=0 <1.35.10	1.39.3, 1.38.6, 1.35.10
debian 14	mediawiki	>=0 <1:1.39.4-1	1:1.39.4-1
debian 12	mediawiki	=1:1.39.2-1 \|\| >=0 <1:1.39.4-1~deb12u1	1:1.39.4-1~deb12u1
debian 11	mediawiki	=1:1.35.2-1 \|\| =1:1.35.3-1 \|\| =1:1.35.4-1 \|\| =1:1.35.4-1+deb11u2 \|\| =1:1.35.4-1~deb11u1 \|\| =1:1.35.5-1 \|\| =1:1.35.5-2 \|\| =1:1.35.6-1 \|\| =1:1.35.7-1 \|\| =1:1.35.8-1 \|\| =1:1.35.8-1.1 \|\| =1:1.35.8-1~deb11u1 \|\| >=0 <1:1.35.11-1~deb11u1	1:1.35.11-1~deb11u1
debian 13	mediawiki	>=0 <1:1.39.4-1	1:1.39.4-1

Aliases

1. CVE-2023-291412. NVD-2023-291413. OSV-2023-291414. OSV-DEBIAN-2023-291415. GCVE-2023-291416. lists.debian.org7. SECURITY-TRACKER-CVE-2023-29141

References

1. https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.392. https://lists.fedoraproject.org/archives/list/[email protected]/message/ONWHGOBFD6CQAEGOP5O375XAP2N6RUHT3. https://lists.fedoraproject.org/archives/list/[email protected]/message/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR74. https://phabricator.wikimedia.org/T2851595. https://www.debian.org/security/2023/dsa-54476. https://www.mediawiki.org/wiki/Release_notes/1.35#MediaWiki_1.35.107. https://www.mediawiki.org/wiki/Release_notes/1.38#MediaWiki_1.38.68. https://www.mediawiki.org/wiki/Release_notes/1.39#MediaWiki_1.39.3