Improper access control in MediaWiki - CVE-2021-30155
Published: April 12, 2021
Vulnerability identifier: #VU52026
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-30155
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions within ContentModelChange, which does not check if a user has correct permissions to create and set the content model of a nonexistent page. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.
Affected software
MediaWiki
Gentoo Linux
mediawiki (Debian package)
Gentoo Linux
mediawiki (Debian package)
How to mitigate CVE-2021-30155
Install updates from vendor's website.
MediaWiki - addressed in versions 1.31.13, 1.35.2
mediawiki (Debian package) - update to 1:1.31.14-1~deb10u1
mediawiki (Debian package) - update to 1:1.31.14-1~deb10u1