high8.8
CVE-2021-41801
The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control.
Impact
The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.31.16 from 1.35.0 before 1.35.4 from 1.36.0 before 1.36.2 |
References
- NVD record
- CVE.org record
- https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
- https://phabricator.wikimedia.org/T279090
- https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
- https://phabricator.wikimedia.org/T279090