Mediawiki Eventbus Extension
Monthly
Sensitive information disclosure in the MediaWiki EventBus extension (affected build 1.47.0-alpha) allows remote, unauthenticated attackers to read event data that should be restricted to authorized event consumers, scoring CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is bounded by configuration and version: EventBus is not a default-bundled MediaWiki extension, so only sites that deliberately install and enable it are reachable, and only the pre-release 1.47.0-alpha branch is listed as affected, which sharply limits the realistic installed base. The independent assessment rates SSVC technical impact as partial rather than full system compromise, and no public exploit identified at time of analysis, although SSVC flags the issue as automatable and exploitation as 'none'.
Sensitive information disclosure in the MediaWiki EventBus extension (affected build 1.47.0-alpha) allows remote, unauthenticated attackers to read event data that should be restricted to authorized event consumers, scoring CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is bounded by configuration and version: EventBus is not a default-bundled MediaWiki extension, so only sites that deliberately install and enable it are reachable, and only the pre-release 1.47.0-alpha branch is listed as affected, which sharply limits the realistic installed base. The independent assessment rates SSVC technical impact as partial rather than full system compromise, and no public exploit identified at time of analysis, although SSVC flags the issue as automatable and exploitation as 'none'.