NetSight
IP …
high7.5

CVE-2021-35197

In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access.

Impact

In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).

Affected products

VendorProductAffected versions
MediawikiMediawiki
before 1.31.15
from 1.32.0 before 1.35.3
from 1.36.0 before 1.36.1
DebianDebian Linux
Versions 9.0, 10.0, 11.0
FedoraprojectFedora
Versions 33, 34, 35

Weakness classification

CWE-863

References