medium6.5
CVE-2021-44857
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
Impact
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.35.5 from 1.36.0 before 1.36.3 from 1.37.0 before 1.37.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://phabricator.wikimedia.org/T297322
- https://security.gentoo.org/glsa/202305-24
- https://www.mediawiki.org/wiki/2021-12_security_release/FAQ
- https://phabricator.wikimedia.org/T297322
- https://security.gentoo.org/glsa/202305-24
- https://www.mediawiki.org/wiki/2021-12_security_release/FAQ