CVE-2025-23073 — API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter

CVE-2025-23073

API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data. This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extension.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / Mediawiki - GlobalBlocking Extension	affected master

CWE

CWE-200, CWE-88

References

https://phabricator.wikimedia.org/T377855
https://gerrit.wikimedia.org/r/q/I2a2d32aedf6328be0a9f1b4e04a6567a25f19486

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.