VDB
Sign up
CRITICAL9.8

GHSA-5vj8-g3qg-4qh6

X-Forwarded-For header allows brute-forcing autoblocked IP addresses

Quick fix

GHSA-5vj8-g3qg-4qh6 — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.39.3

Details

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 1.39.0Fixed in: 1.39.3
Fixcomposer require mediawiki/core:^1.39.3
Packagist/mediawiki/core
Introduced in: 1.38.0Fixed in: 1.38.6
Fixcomposer require mediawiki/core:^1.38.6
Packagist/mediawiki/core
Introduced in: 0Fixed in: 1.35.10
Fixcomposer require mediawiki/core:^1.35.10

References