PT-2021-19423 · Mediawiki+1 · Mediawiki+1

Marcoaurelio · Published 2021-04-22 · Updated 2024-03-06 · CVE-2021-31552

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35.2

Description An issue in the AbuseFilter extension for MediaWiki allows certain rules related to blocking accounts after account creation to be executed incorrectly. This could enable user accounts to be created while only blocking the IP address used for creation, rather than the account itself. Additionally, a malicious, unprivileged user could utilize such rules to catalog and enumerate numerous IP addresses associated with account creations.

Recommendations For MediaWiki versions through 1.35.2, update to a version that includes a fix for this issue to prevent incorrect execution of AbuseFilter rules. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2021-1991

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-31552

CVE-2021-31552

Affected Products

Alt Linux

Mediawiki

References · 5

• https://osv.dev/vulnerability/CVE-2021-31552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31552 · Security Note
• https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d0190335363ac2decf28e4313da1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-31552 · Vendor Advisory
• https://phabricator.wikimedia.org/T152394 · Note