This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-35197 →
DEBIAN-CVE-2021-35197
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot accoun...
Original description
The description as published by the source.
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.3-1"}]}]
Debian:13
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.3-1"}]}]
Debian:14
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.3-1"}]}]
References
- advisory security-tracker.debian.org