PT-2021-24161 · Mediawiki+1 · Mediawiki+1

Dylsss · Published 2021-12-15 · Updated 2024-03-06 · CVE-2021-44857

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1

Description: An issue allows replacing the content of any arbitrary page using action=mcrundo followed by action=mcrrestore, even if the user does not have edit rights for that page. This issue affects any public wiki or a private wiki with at least one page set in $wgWhitelistRead.

Recommendations: For MediaWiki versions prior to 1.35.5, update to version 1.35.5 or later. For MediaWiki versions 1.36.x prior to 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x prior to 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the action=mcrundo and action=mcrrestore actions until a patch is applied.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BIT-MEDIAWIKI-2021-44857

CVE-2021-44857

DSA-5021-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 19

• https://cve.org/CVERecord?id=CVE-2021-44857 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-44857 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44857 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://mediawiki.org/wiki/2021-12_security_release/FAQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44857 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2021-44857 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5021-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44857 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44857 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44857 · Vendor Advisory
• https://github.com/advisories/GHSA-x4wg-g4fv-f8m6 · Note
• https://lists.wikimedia.org/hyperkitty/list/[e-mail]/thread/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA · Note