PT-2022-4988 · Mediawiki+1 · Mediawiki+1

Func · Published 2021-12-19 · Updated 2024-03-06 · CVE-2021-44856

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.35.5 and earlier, 1.36.x before 1.36.3, 1.37.x before 1.37.1

Description The issue is related to the mishandling of the EditFilterMergedContent hook return value in the Special:ChangeContentModel function. This can allow a title blocked by AbuseFilter to be created, potentially affecting the confidentiality, integrity, and availability of protected information.

Recommendations For MediaWiki versions 1.35.5 and earlier, update to version 1.35.5 or later. For MediaWiki versions 1.36.x before 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x before 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the Special:ChangeContentModel function until a patch is available.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-254

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BDU:2022-06191

BIT-MEDIAWIKI-2021-44856

CVE-2021-44856

DLA-3117-1

DSA-5246-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 22

• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44856 · Security Note
• https://osv.dev/vulnerability/DLA-3117-1 · Vendor Advisory
• https://phabricator.wikimedia.org/T271037 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06191 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2021-44856 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44856 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44856 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-44856 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44856 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44856 · Security Note
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note