PT-2023-12138 · Mediawiki+1 · Visualeditor+2

Dannys712 · Publicado 2021-04-25 · Atualizado 2024-03-06 · CVE-2021-30153

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.31 through 1.31.12 MediaWiki versions 1.32.x through 1.35.1

Description An issue was discovered in the VisualEditor extension. When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. This is related to ApiVisualEditor.

Recommendations For MediaWiki versions 1.31 through 1.31.12, update to version 1.31.13 or later. For MediaWiki versions 1.32.x through 1.35.1, update to version 1.35.2 or later. As a temporary workaround, consider restricting access to the ApiVisualEditor until a patch is available.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

ALT-PU-2021-1712

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-30153

CVE-2021-30153

Produtos afetados

Alt Linux

Mediawiki

Visualeditor

Referências · 78

• 🔥 https://phabricator.wikimedia.org/T270453 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36125 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35622 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30158 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31550 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36131 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2021-2091 · Aviso do Fabricante
• https://phabricator.wikimedia.org/T260865 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31551 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30159 · Nota de Segurança
• https://phabricator.wikimedia.org/T272386 · Nota
• https://bdu.fstec.ru/vul/2021-03741 · Nota de Segurança
• https://phabricator.wikimedia.org/T270988 · Nota
• https://t.me/cvenotify/48343 · Publicação no Telegram
• https://packages.altlinux.org/ru/vuln/CVE-2021-30153 · Nota