CVE-2021-44857

Description

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesnt have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.149

Associated Vulnerability

Vulnerability	OS Platform
mediawiki security update(DSA-5021-1) mediawiki_1.35.4-1+deb11u2_all.deb	Linux
mediawiki security update(DSA-5021-1) mediawiki_1.31.16-1+deb10u2_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234