high7.5
CVE-2021-44858
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
Impact
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.35.5 from 1.36.0 before 1.36.3 from 1.37.0 before 1.37.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://phabricator.wikimedia.org/T297322
- https://security.gentoo.org/glsa/202305-24
- https://www.mediawiki.org/wiki/2021-12_security_release/FAQ
- https://phabricator.wikimedia.org/T297322
- https://security.gentoo.org/glsa/202305-24
- https://www.mediawiki.org/wiki/2021-12_security_release/FAQ