This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-44858 →
DEBIAN-CVE-2021-44858
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed b...
Original description
The description as published by the source.
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.5-1"}]}]
Debian:13
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.5-1"}]}]
Debian:14
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.5-1"}]}]
References
- advisory security-tracker.debian.org