CVE-2023-37303

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3

published June 30, 2023

CVSS
—
EPSS
1%
Percentile
61.0
In the wild
Unconfirmed
What it is

⚠️ User blocking might just fizzle out! In the CheckUser extension for MediaWiki, a tiny hiccup in your browser could leave you frustrated as user blocks fail unexpectedly. 🔥 Think of it like trying to mute a rowdy diner at a restaurant, but the waiter gets distracted mid-order — the diner continues their antics while you wait for the waitstaff to regroup. If a blocking attempt fails, it could leave unwanted users running amok, leading to potential chaos in your wiki environment. While this particular glitch isn’t known to be exploited yet, the uncertainty looms large like a storm cloud overhead.

Put simply

Think of it like trying to mute a rowdy diner at a restaurant, but the waiter gets distracted mid-order — the diner continues their antics while you wait for the waitstaff to regroup. This vulnerability stems from a scenario where a temporary browser freeze and a DBQueryDisconnectedError prevent user blocking in the CheckUser extension for versions up to 1.39.3, essentially failing to enforce user restrictions when they need to be applied.

What to do

If a blocking attempt fails, it could leave unwanted users running amok, leading to potential chaos in your wiki environment. While this particular glitch isn’t known to be exploited yet, the uncertainty looms large like a storm cloud overhead. To safeguard your MediaWiki instance, consider updating to the latest version beyond 1.39.3 to resolve this issue. It's also wise to monitor user access closely during blocking attempts until you're patched up. You've got this! Stay vigilant, update regularly, and keep your wiki safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00953 · 61.0th percentile
Published
2023-06-30T00:00Z
EPSS history
Timeline
  • 30 JUN 00:00Z
    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3
    cvelistv5