Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2023-45361: MediaWiki: Malformed Page Titles Can Cause Incorrect Pages
CVE-2023-45361 · published 2 years ago
Summary
MediaWiki versions before 1.40.1 are vulnerable to a bug that can cause incorrect pages to be displayed. If a user enters a malformed page title, MediaWiki may not catch the error, leading to unintended web pages being shown. To fix this issue, update to MediaWiki version 1.40.1 or later.
What to do
- Update debian mediawiki to version 1:1.39.5-1~deb12u1.
- Update debian mediawiki to version 1:1.39.5-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:25.10 | canonical | mediawiki | All versions |
| Ubuntu:26.04:LTS | canonical | mediawiki | All versions |
| Debian:12 | debian | mediawiki |
< 1:1.39.5-1~deb12u1 Fix: upgrade to 1:1.39.5-1~deb12u1
|
| Debian:13 | debian | mediawiki |
< 1:1.39.5-1 Fix: upgrade to 1:1.39.5-1
|
Original advisory text
An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it...
An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it is not a valid title, leading to incorrect web pages.
References
- https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/skins/Vector/+/2a452b7e...
- https://ubuntu.com/security/CVE-2023-45361 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-45361 Third Party Advisory
- https://phabricator.wikimedia.org/T340220 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-45361 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Timeline
Published9 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta