ArchLinuxASA-202107-7[ASA-202107-7] mediawiki: access restriction bypass
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.0%
Arch Linux Security Advisory ASA-202107-7
Severity: Medium
Date : 2021-07-01
CVE-ID : CVE-2021-35197
Package : mediawiki
Type : access restriction bypass
Remote : Yes
Link : https://security.archlinux.org/AVG-2093
Summary
The package mediawiki before version 1.36.1-1 is vulnerable to access
restriction bypass.
Resolution
Upgrade to 1.36.1-1.
pacman -Syu “mediawiki>=1.36.1-1”
The problem has been fixed upstream in version 1.36.1.
Workaround
None.
Description
A security issue has been found in MediaWiki before version 1.36.1 that
allows blocked users to purge pages.
Impact
Blocked users could purge pages.
References
https://lists.wikimedia.org/hyperkitty/list/[email protected]/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/
https://phabricator.wikimedia.org/T280226
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c1205e13c7a8332ab39e6ff52ca107^!/
https://security.archlinux.org/CVE-2021-35197
References
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.012 Low
EPSS
Percentile
85.0%