CVE-2023-37253
Received Received - Intake

ProofreadPage Extension Information Disclosure Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: MITRE

Description
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2023-37253
EUVD
EUVD-2023-60664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mediawiki proofreadpage 1.39.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the ProofreadPage extension for MediaWiki. It allows suppressed user names to be exposed through public interfaces like the API and configuration variables. For example, a hidden reviewer's username could still be visible via the mw.config.get('prpPageQualityUser') method or API calls returning page wikitext.

Detection Guidance

Check MediaWiki API responses for suppressed user data by querying pages in the Page: namespace and inspecting the mw.config.get('prpPageQualityUser') variable or API outputs. Look for user names that should be hidden but are exposed.

Impact Analysis

If you are a user whose username was suppressed for privacy, this vulnerability could expose your identity to unauthorized users. It undermines the intended privacy settings, potentially revealing sensitive information about your contributions or actions on the platform.

Compliance Impact

This vulnerability could lead to non-compliance with privacy regulations like GDPR or HIPAA by exposing personal data (suppressed usernames) without proper authorization. It violates the principle of data minimization and user privacy rights.

Mitigation Strategies

Update the ProofreadPage extension to the patched version provided for MediaWiki 1.38, 1.39, or 1.40. Ensure the patch is applied across all affected instances to prevent hidden user names from being exposed via API or config variables.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-37253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart