PT-2021-6994 · Mediawiki · Mediawiki Report Extension

Published 2021-01-25 · Updated 2022-04-26 · CVE-2021-21275

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki Report extension (affected versions not specified)

Description The issue is related to a Cross-Site Request Forgery (CSRF) vulnerability. It allows a remote attacker to impact the integrity of protected information by forging requests to report a revision. The vulnerability is due to the lack of protection against CSRF checks on Special:Report. The problem was fixed by utilizing MediaWiki edit tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2022-02828

CVE-2021-21275

GHSA-9F3W-C334-JM2H

Affected Products

Mediawiki Report Extension

References · 9

• https://github.com/Kenny2github/Report/security/advisories/GHSA-9f3w-c334-jm2h · Patch
• https://github.com/Kenny2github/Report/commit/f828dc6f73cdfaea5639edbf8ac7b326eeefb117 · Patch
• https://bdu.fstec.ru/vul/2022-02828 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21275 · Security Note
• https://oracle.com//security-alerts/cpujul2021.html · Note
• https://t.me/cibsecurity/22564 · Telegram Post
• https://t.me/cvenotify/8953 · Telegram Post
• https://oracle.com/security-alerts/cpuapr2022.html · Note