PT-2021-24162 · Mediawiki+1 · Mediawiki+1

Dylsss · Published 2021-12-15 · Updated 2024-03-06 · CVE-2021-44858

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1

Description: An issue allows viewing private pages on a private wiki with at least one page set in $wgWhitelistRead by using specific actions in sequence, such as action=edit&undo= followed by action=mcrundo and action=mcrrestore.

Recommendations: For MediaWiki versions prior to 1.35.5, update to version 1.35.5 or later. For MediaWiki versions 1.36.x prior to 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x prior to 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the action=mcrundo and action=mcrrestore endpoints to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BIT-MEDIAWIKI-2021-44858

CVE-2021-44858

DLA-2847-1

DSA-5021-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 20

• https://ubuntu.com/security/CVE-2021-44858 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44858 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44858 · Security Note
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2021-44858 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://mediawiki.org/wiki/2021-12_security_release/FAQ · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2847-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44858 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44858 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5021-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-44858 · Vendor Advisory
• https://phabricator.wikimedia.org/T297322 · Vendor Advisory