PT-2021-24192 · Mediawiki+1 · Mediawiki+1

Dylsss · Published 2021-12-15 · Updated 2024-03-06 · CVE-2021-45038

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1

Description: An issue was discovered in MediaWiki. By using an action=rollback query, attackers can view private wiki contents.

Recommendations: For MediaWiki versions prior to 1.35.5, update to version 1.35.5 or later. For MediaWiki versions 1.36.x prior to 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x prior to 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the action=rollback query until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BIT-MEDIAWIKI-2021-45038

CVE-2021-45038

DSA-5021-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2021-45038 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2021-45038 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note
• https://ubuntu.com/security/CVE-2021-45038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45038 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://mediawiki.org/wiki/2021-12_security_release/FAQ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-45038 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-45038 · Security Note
• https://osv.dev/vulnerability/DSA-5021-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-45038 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45038 · Vendor Advisory
• https://phabricator.wikimedia.org/T297574 · Note
• https://t.me/cibsecurity/34177 · Telegram Post