PT-2022-5003 · Mediawiki+1 · Mediawiki+1

Dylsss · Published 2021-12-19 · Updated 2024-03-06 · CVE-2021-44854

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.5 MediaWiki versions 1.36.x prior to 1.36.3 MediaWiki versions 1.37.x prior to 1.37.1

Description An issue was discovered in the REST API of MediaWiki, which publicly caches results from private wikis, potentially leading to information disclosure. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For MediaWiki versions prior to 1.35.5, update to version 1.35.5 or later. For MediaWiki versions 1.36.x prior to 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x prior to 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider disabling the REST API until a patch is available. Restrict access to private wikis to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-524

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BDU:2022-06216

BIT-MEDIAWIKI-2021-44854

CVE-2021-44854

DSA-5246-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 21

• https://bdu.fstec.ru/vul/2022-06216 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-44854 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44854 · Vendor Advisory
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://phabricator.wikimedia.org/T292763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44854 · Security Note
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44854 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-44854 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44854 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44854 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44854 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6 · Note