p PatchFirst

CVE-2021-44857

CVE-2021-44857

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.

CVSS 6.5 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mediawiki Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:1.35.5-1

    Update to 1:1.35.5-1

  • mediawiki Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:1.35.5-1

    Update to 1:1.35.5-1

  • mediawiki Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:1.35.5-1

    Update to 1:1.35.5-1

Original sources

Check your server →