PT-2023-12138 · Mediawiki+1 · Visualeditor+2

Dannys712 · Published 2021-04-25 · Updated 2024-03-06 · CVE-2021-30153

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.31 through 1.31.12 MediaWiki versions 1.32.x through 1.35.1

Description An issue was discovered in the VisualEditor extension. When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. This is related to ApiVisualEditor.

Recommendations For MediaWiki versions 1.31 through 1.31.12, update to version 1.31.13 or later. For MediaWiki versions 1.32.x through 1.35.1, update to version 1.35.2 or later. As a temporary workaround, consider restricting access to the ApiVisualEditor until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALT-PU-2021-1712

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-30153

CVE-2021-30153

Affected Products

Alt Linux

Mediawiki

Visualeditor

References · 78

• 🔥 https://phabricator.wikimedia.org/T270453 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36125 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35622 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30158 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31550 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36131 · Security Note
• https://errata.altlinux.org/ALT-PU-2021-2091 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31551 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30159 · Security Note
• https://bdu.fstec.ru/vul/2021-03741 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31553 · Security Note
• https://bdu.fstec.ru/vul/2021-03170 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31546 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35625 · Security Note
• https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html · Vendor Advisory