Improper access control in MediaWiki - CVE-2021-41800
Published: October 1, 2021
Vulnerability identifier: #VU56982
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41800
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions, related to PoolCounter and Special:Contributions section. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Affected software
MediaWiki
mediawiki (Debian package)
mediawiki
Fedora
mediawiki (Debian package)
mediawiki
Fedora
How to mitigate CVE-2021-41800
Install updates from vendor's website.
MediaWiki - addressed in versions 1.31.16, 1.35.4, 1.36.2
mediawiki (Debian package) - addressed in versions 1:1.31.16-1~deb10u1, 1:1.35.4-1~deb11u1
mediawiki - addressed in versions 1.35.4-1.fc33, 1.35.4-1.fc34, 1.36.2-1.fc35
mediawiki (Debian package) - addressed in versions 1:1.31.16-1~deb10u1, 1:1.35.4-1~deb11u1
mediawiki - addressed in versions 1.35.4-1.fc33, 1.35.4-1.fc34, 1.36.2-1.fc35