{"action":"Upgrade mediawiki/core to 1.35.10 or later.","affected":[{"fixed":"1.39.3","introduced":"1.39.0"},{"fixed":"1.38.6","introduced":"1.38.0"},{"fixed":"1.35.10","introduced":"0"}],"component":"mediawiki/core","cve_ids":["CVE-2023-29141"],"ecosystem":"Packagist","epss":0.01194,"exploited":false,"fixed_versions":["1.39.3","1.38.6","1.35.10"],"ghsa_id":"GHSA-5vj8-g3qg-4qh6","id":"tcs_01M5KEWD7P8GQZBQ19Z2JCZAN1","modified_at":"2025-02-18T23:11:36.635943Z","published_at":"2023-03-31T21:30:40Z","references":["https://osv.dev/vulnerability/GHSA-5vj8-g3qg-4qh6","https://nvd.nist.gov/vuln/detail/CVE-2023-29141","https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.39","https://github.com/wikimedia/mediawiki","https://lists.debian.org/debian-lts-announce/2023/08/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ONWHGOBFD6CQAEGOP5O375XAP2N6RUHT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR7","https://phabricator.wikimedia.org/T285159","https://www.debian.org/security/2023/dsa-5447","https://www.mediawiki.org/wiki/Release_notes/1.35#MediaWiki_1.35.10","https://www.mediawiki.org/wiki/Release_notes/1.38#MediaWiki_1.38.6","https://www.mediawiki.org/wiki/Release_notes/1.39#MediaWiki_1.39.3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-5vj8-g3qg-4qh6","url":"https://osv.dev/vulnerability/GHSA-5vj8-g3qg-4qh6"}],"summary":"X-Forwarded-For header allows brute-forcing autoblocked IP addresses"}