CVE-2024-34502: Cross-Site Request Forgery (CSRF)

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

CVE-2024-34502

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

CVE-2024-34502

An access control vulnerability exists in the WikibaseLexeme extension of MediaWiki affecting versions before 1.39.6 , 1.40.x before 1.40.2 , and 1.41.x before 1.41.1 . The issue allows an attacker to trigger an edit that merges a from-id to a to-id when loading Special:MergeLexemes , even if the...