Wikimedia MediaWiki CentralAuth Extension Resource Leak Vulnerability

A vulnerability in the Wikimedia Foundation's MediaWiki CentralAuth Extension allows for the improper removal of sensitive information, such as email addresses, before storage or transfer. This issue leads to a resource leak by exposing residual sensitive data. The vulnerability affects non-release branches of the CentralAuth Extension.

Impact

Exploitation of this vulnerability could result in the unintended exposure of user email addresses and other sensitive information, such as password data, from the global user database to local wiki databases.

Reproduction

The vulnerability can be reproduced by initiating a global account vanishing process for a user. This process is supposed to remove the user's email from all databases. However, the email remains in the local user table of individual wikis, creating a discrepancy and potential information leak.

Remediation

The vulnerability has been addressed in version 1.46.0-wmf.16 of the MediaWiki CentralAuth Extension.