CVE-2023-22945 Information

Description

In the GrowthExperiments extension for MediaWiki through 1.39 the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit any of their mentorship-related properties.

Reference

https://phabricator.wikimedia.org/T321733 https://gerrit.wikimedia.org/r/q/Id1b83fcd58eccb8b2dfea44a3ab2f72314860d88