In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
12 Jul 2022, 17:42
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-863 |
23 Nov 2021, 21:32
Type | Values Removed | Values Added |
---|---|---|
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - Mailing List, Third Party Advisory | |
References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/10/msg00003.html - Mailing List, Third Party Advisory | |
CPE | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
17 Nov 2021, 22:18
Type | Values Removed | Values Added |
---|---|---|
References |
|
10 Nov 2021, 01:17
Type | Values Removed | Values Added |
---|---|---|
References |
|
30 Oct 2021, 02:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
18 Oct 2021, 11:54
Type | Values Removed | Values Added |
---|---|---|
References | (DEBIAN) https://www.debian.org/security/2021/dsa-4979 - Third Party Advisory | |
References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/10/msg00003.html - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/ - Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/ - Third Party Advisory | |
CPE | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
13 Oct 2021, 02:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
09 Oct 2021, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
04 Oct 2021, 23:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
20 Sep 2021, 18:55
Type | Values Removed | Values Added |
---|---|---|
References |
|
07 Jul 2021, 17:11
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
CPE | cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:* | |
CWE | CWE-668 | |
References | (MISC) https://phabricator.wikimedia.org/T280226 - Exploit, Vendor Advisory | |
References | (CONFIRM) https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/ - Patch, Vendor Advisory |
02 Jul 2021, 13:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-07-02 13:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-35197
Mitre link : CVE-2021-35197
CVE.ORG link : CVE-2021-35197
JSON object : View
Products Affected
debian
- debian_linux
fedoraproject
- fedora
mediawiki
- mediawiki
CWE
CWE-863
Incorrect Authorization