Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-40596
CVE-2024-40596:
NixOS vulnerability analysis and mitigation
Overview
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. The vulnerability exists because TimelineService does not support properly suppressing log events. This issue was discovered in January 2023 and was assigned CVE-2024-40596 (NVD, Phabricator).
Technical details
The vulnerability stems from the CheckUser extension's inability to properly handle suppressed log events in the TimelineService component. The core issue is that CheckUser does not store the log ID, which is necessary to look up the revision deletion status. This technical limitation means that checkusers who do not have oversight permissions can access oversighted logs (Phabricator). The vulnerability has been assigned a CVSS v3.1 base score of 4.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) (NVD).
Impact
The vulnerability allows users with CheckUser permissions but without oversight permissions to access suppressed log information that should be restricted. This represents an information disclosure vulnerability that could potentially expose sensitive or private information that was intentionally suppressed (Phabricator).
Mitigation and workarounds
The issue has been fixed by implementing support for storing log IDs and properly checking suppression status in the TimelineService component. The fix was merged in May 2024 and includes updates to the TimelineRowFormatter and the addition of read new support to the TimelineService (Phabricator).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management