API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.5epss 0.3%
exploitation probability
0.3%top 72% of all CVEs
observed exploitation
nono source reports it
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data.
This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extension.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected products
Wikimedia Foundation · Mediawiki - GlobalBlocking Extension