This vulnerability, identified as CWE-212, concerns improper removal of sensitive information before storage or transfer within the Mediawiki CentralAuth Extension maintained by The Wikimedia Foundation. It can lead to resource leak exposure, potentially allowing unauthorized access to sensitive data. The vulnerability affects MediaWiki versions 1.43, 1.44, and 1.45 but has been addressed in the master branch and these release branches. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, with high impact on confidentiality and low to limited impact on integrity and availability. No known exploits have been reported, and the vendor has remediated the issue in the relevant branches.

The vulnerability allows sensitive information to be improperly retained or exposed due to insufficient removal before storage or transfer, which could lead to unauthorized disclosure of sensitive data. The CVSS score of 8.8 reflects a high impact on confidentiality with some impact on integrity and availability. There are no known active exploits in the wild, reducing immediate risk, but the potential for data leakage remains significant if unpatched.

The vulnerability has been remediated by The Wikimedia Foundation in the master branch and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45. Users should upgrade to these fixed versions to address the issue. Since the vendor advisory confirms remediation in these branches, applying the official updates is the recommended action. Patch status is confirmed by vendor advisory content indicating fixes are available in the specified branches.