PT-2021-19424 · Mediawiki+1 · Mediawiki+2

Martin Urbanec + 1 · Published 2021-04-22 · Updated 2024-03-06 · CVE-2021-31553

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35.2

Description An issue in the CheckUser extension allows MediaWiki usernames with trailing whitespace to be stored in the cu log database table, causing denial of service for certain CheckUser extension pages and functionality. This could interfere with usage tracking, for example, by turning off Special:CheckUserLog.

Recommendations For versions through 1.35.2, consider temporarily restricting access to the CheckUser extension until a fix is applied to prevent the storage of usernames with trailing whitespace in the cu log database table.

Fix

DoS

Weakness Enumeration

CWE-428

Related Identifiers

ALT-PU-2021-1991

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-31553

CVE-2021-31553

Affected Products

Alt Linux

Checkuser Extension

Mediawiki

References · 10

• https://osv.dev/vulnerability/BIT-mediawiki-2021-31553 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31553 · Security Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667025 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667024 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667027 · Note
• https://phabricator.wikimedia.org/T275669 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023 · Note