Security restrictions bypass in MediaWiki - CVE-2021-41801
Published: October 1, 2021
Vulnerability identifier: #VU56983
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41801
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security checks.
The vulnerability exists due to application does not properly check permissions when executing jobs. A remote user can execute actions, such as global replacement of text in wiki articles even after their permissions have been revoked.
Affected software
MediaWiki
mediawiki (Debian package)
mediawiki (Debian package)
How to mitigate CVE-2021-41801
Install updates from vendor's website.
MediaWiki - addressed in versions 1.31.16, 1.35.4, 1.36.2
mediawiki (Debian package) - addressed in versions 1:1.31.16-1~deb10u1, 1:1.35.4-1~deb11u1
mediawiki (Debian package) - addressed in versions 1:1.31.16-1~deb10u1, 1:1.35.4-1~deb11u1