Non évaluée
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by a...
CVE-2021-44857
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2021-44857 mediawiki Corrigé dans: 1:1.35.5-1
Description d'origine La description telle que publiée par la source (souvent en anglais).
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.
Références
- advisory phabricator.wikimedia.org
- advisory security.gentoo.org
- advisory mediawiki.org