PT-2021-19425 · Mediawiki+1 · Mediawiki+2

Daimona · Published 2021-04-22 · Updated 2024-03-06 · CVE-2021-31554

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35.2 AbuseFilter extension for MediaWiki versions through 1.35.2

Description An issue in the AbuseFilter extension for MediaWiki improperly handled account blocks for certain automatically created MediaWiki user accounts. This allowed malicious users to remain unblocked.

Recommendations For MediaWiki versions through 1.35.2, update to a version that includes a fix for the issue in the AbuseFilter extension. For the AbuseFilter extension for MediaWiki versions through 1.35.2, update the extension to a version that properly handles account blocks for automatically created user accounts.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2021-1991

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-31554

CVE-2021-31554

Affected Products

Alt Linux

Abusefilter Extension

Mediawiki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-31554 · Security Note
• https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31554 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-31554 · Vendor Advisory
• https://phabricator.wikimedia.org/T272244 · Note