An issue exists in DifferenceEngine.php in MediaWiki prior to 1.35.12, 1.36.x up to and including 1.39.x prior to 1.39.5, and 1.40.x prior to 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mediawiki mediawiki 1.40.0 |
||
mediawiki mediawiki |
Vulmon