MediaWiki AbuseFilter API Authorization Bypass Fix (CVE-2024-PENDING)

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - Title: SECURITY: abusefiltercheckmatch: Check if user can see log details - CVE ID: CVE-2024-PENDING - Cause: - The API allows callers to match any filter conditions against existing AbuseFilter logs. - The API does not check whether the requester has permission to view the log details for the given filter, potentially allowing users to bypass hidden or protected visibility settings. 2. Fixes: - Code Changes: - Added a call to in . - Added tests in to verify the effectiveness of this security fix. 3. Status: - Status: Merged - Commit Date: October 1, 2024 4. Participants: - Committer: Reedy - Author: Dreamy Jazz - Reviewers: TheresNoTime, Daimona Eayto, jenkins-bot, SonarQube Bot - CC: Dreamy Jazz 5. Code Review Status: - Code Review: Passed (Code-Review +2) - Verification: Passed (Verified +2) 6. Testing: - Test Coverage: Increased PHP test coverage. - Test Results: Quality gate passed; reliability rating, security rating, maintainability rating, and coverage passed. 7. Merge Status: - Merge Status: Merged, merge time: October 1, 2024, 7:39 AM This information indicates that the vulnerability has been fixed, passed code review and testing, and has been successfully merged into the codebase.

Goal Reached Thanks to every supporter — we hit 100%!

MediaWiki AbuseFilter API Authorization Bypass Fix (CVE-2024-PENDING)