CVE-2023-45362: 
NixOS vulnerability analysis and mitigation

CVE-2023-45362 is a security vulnerability discovered in MediaWiki's DifferenceEngine.php component affecting versions before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. The vulnerability relates to the diff-multi-sameuser feature, which ignores username suppression, leading to potential information leaks (Debian LTS, Wikimedia Phabricator).

The vulnerability exists in the DifferenceEngine.php component where the diff-multi-sameuser feature (which shows "X intermediate revisions by the same user not shown") fails to properly handle suppressed usernames. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability results in an information leak where suppressed usernames could potentially be exposed through the diff comparison feature. This compromises the privacy protections intended by the username suppression feature (Debian LTS).

The vulnerability has been patched in MediaWiki versions 1.35.12, 1.39.5, and 1.40.1. The fix modifies the DifferenceEngine to properly handle suppressed usernames by reducing the edit count when a user for a given revision is suppress-deleted (Wikimedia Phabricator).