[CRITICAL] X-Forwarded-For header allows brute-forcing autoblocked IP addresses

PKSA-sywz-vkhh-67ff CVE-2023-29141 GHSA-5vj8-g3qg-4qh6

Affected package: mediawiki/core

Affected version: <1.35.10|>=1.38.0,<1.38.6|>=1.39.0,<1.39.3

Reported by:
GitHub