Mediawiki Translate Extension
Monthly
Missing authorization checks in the MediaWiki Translate extension let any logged-in user with network access invoke translation-management functionality that should have been constrained by ACLs, affecting installations running versions prior to 1.46.1, 1.45.5, and 1.43.10. The impact is confined to integrity - an authenticated low-privilege attacker cannot read protected data or cause a denial of service - giving a CVSS 3.1 base score of 5.3, and no public exploit code has been identified at time of analysis. Exploitation requires a valid registered account on a wiki where the Translate extension is enabled, so exposure is limited to those deployments.
Missing authorization checks in the MediaWiki Translate extension let any logged-in user with network access invoke translation-management functionality that should have been constrained by ACLs, affecting installations running versions prior to 1.46.1, 1.45.5, and 1.43.10. The impact is confined to integrity - an authenticated low-privilege attacker cannot read protected data or cause a denial of service - giving a CVSS 3.1 base score of 5.3, and no public exploit code has been identified at time of analysis. Exploitation requires a valid registered account on a wiki where the Translate extension is enabled, so exposure is limited to those deployments.