Mediawiki Pagetriage Extension
Monthly
Information disclosure in the MediaWiki PageTriage extension (versions 1.43, 1.45, and 1.46) allows an authenticated, low-privileged user to elicit restricted data through the extension's data-query interface. Exploitation requires a specific precondition (AT:P) and passive user interaction (UI:P), and the impact is limited to low confidentiality loss with no effect on integrity or availability; no public exploit identified at time of analysis. The Wikimedia Foundation has published an upstream fix via Gerrit, and this is a low-priority issue that does not warrant urgent action.
Information disclosure in the MediaWiki PageTriage extension (versions 1.43, 1.45, and 1.46) allows an authenticated, low-privileged user to elicit restricted data through the extension's data-query interface. Exploitation requires a specific precondition (AT:P) and passive user interaction (UI:P), and the impact is limited to low confidentiality loss with no effect on integrity or availability; no public exploit identified at time of analysis. The Wikimedia Foundation has published an upstream fix via Gerrit, and this is a low-priority issue that does not warrant urgent action.