~ / search / GHSA-5vj8-g3qg-4qh6

GHSA-5vj8-g3qg-4qh6

X-Forwarded-For header allows brute-forcing autoblocked IP addresses

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-29141

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core >= 1.39.0, < 1.39.3 1.39.3
Packagist mediawiki/core >= 1.38.0, < 1.38.6 1.38.6
Packagist mediawiki/core < 1.35.10 1.35.10

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

References

External links from the advisory. They lead to third-party sites.