medium4.3
CVE-2021-30155
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2.
Impact
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.31.12 from 1.32.0 before 1.35.2 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
| Fedoraproject | Fedora | Versions 33, 34 |
Weakness classification
References
- NVD record
- CVE.org record
- https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T270988
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889
- https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html
- https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
- https://phabricator.wikimedia.org/T270988
- https://security.gentoo.org/glsa/202107-40
- https://www.debian.org/security/2021/dsa-4889