PT-2021-6527 · Mediawiki+1 · Mediawiki+1

Legoktm · Published 2021-06-27 · Updated 2024-03-06 · CVE-2021-35197

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.31.15 and earlier MediaWiki versions 1.32.x through 1.35.x before 1.35.3 MediaWiki versions 1.36.x before 1.36.1

Description The issue concerns unintended API access for bots in MediaWiki. When a bot account has a "sitewide block" applied, it can still "purge" pages through the MediaWiki Action API, which should have been prevented by the block. This could potentially allow a remote attacker to impact data integrity.

Recommendations For MediaWiki versions 1.31.15 and earlier, update to version 1.31.15 or later. For MediaWiki versions 1.32.x through 1.35.x before 1.35.3, update to version 1.35.3 or later. For MediaWiki versions 1.36.x before 1.36.1, update to version 1.36.1 or later. As a temporary workaround, consider restricting access to the MediaWiki Action API for bot accounts with a "sitewide block" applied.

Exploit

Fix

Incorrect Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-863

CWE-668

Related Identifiers

ALT-PU-2021-2064

ALT-PU-2021-2091

BDU:2022-01787

BIT-MEDIAWIKI-2021-35197

CVE-2021-35197

DLA-2779-1

DSA-4979-1

MGASA-2021-0346

Affected Products

Alt Linux

Mediawiki

References · 32

• 🔥 https://phabricator.wikimedia.org/T280226 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN · Vendor Advisory
• https://security.gentoo.org/glsa/202107-40 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-35197 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35197 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2779-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35197 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01787 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-35197 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-35197 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-35197 · Vendor Advisory
• https://debian.org/security/2021/dsa-4979 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35197 · Vendor Advisory