medium5.3
CVE-2021-21275
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability.
Impact
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Report Project | Report | before 2021-01-21 |
| Oracle | Communications Cloud Native Core Network Slice Selection Function | Version 1.2.1 |
| Oracle | Communications Pricing Design Center | Versions 12.0.0.4.0, 12.0.0.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Kenny2github/Report/commit/f828dc6f73cdfaea5639edbf8ac7b326eeefb117
- https://github.com/Kenny2github/Report/security/advisories/GHSA-9f3w-c334-jm2h
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/Kenny2github/Report/commit/f828dc6f73cdfaea5639edbf8ac7b326eeefb117
- https://github.com/Kenny2github/Report/security/advisories/GHSA-9f3w-c334-jm2h
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html