Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

Mageia 8: 2021-0568 Moderate: Unauthorized Access in MediaWiki

mageia
Calendar Grey December 19, 2021
Dist Mageia Esm H88
Mageia 8 mediawiki patch resolves several security vulnerabilities. Discover important flaws and remedies from December 2021.
Updated mediawiki packages fix security vulnerabilities: == Security fixes == * (T292763

Summary

Updated mediawiki packages fix security vulnerabilities:
== Security fixes =* (T292763. CVE-2021-44854) REST API incorrectly publicly caches autocomplete search results from private wikis. * (T271037, CVE-2021-44856) Title blocked in AbuseFilter can be created via Special:ChangeContentModel. * (T297322, CVE-2021-44857) Unauthorized users can use action=mcrundo to replace the content of arbitrary pages. * (T297322, CVE-2021-44858) Unauthorized users can view contents of private wikis using various actions. * (T297574, CVE-2021-45038) Unauthorized users can access private wiki contents using rollback action
=== Extension security fixes ==* (T293589, CVE-2021-44855) Blind Stored XSS in VisualEditor media dialog. * (T294686) Special:Nuke doesn't actually delete pages.

References

- https://bugs.mageia.org/show_bug.cgi?id=29772

- https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/QEN3EK4JXAVJMJ5GF3GYOAKNJPEKFQYA/

- https://www.cve.org/CVERecord?id=CVE-2021-44854

- https://www.cve.org/CVERecord?id=CVE-2021-44855

- https://www.cve.org/CVERecord?id=CVE-2021-44856

- https://www.cve.org/CVERecord?id=CVE-2021-44857

- https://www.cve.org/CVERecord?id=CVE-2021-44858

- https://www.cve.org/CVERecord?id=CVE-2021-45038

Topics%20covered

Topics Covered

security advisory moderate unauthorized access XSS access control MediaWiki Mageia

Resolution

SRPMS

- 8/core/mediawiki-1.35.5-1.mga8

Severity
medium
Lowest
Low
Medium
High
Critical

Publication date: 19 Dec 2021
URL: https://advisories.mageia.org/MGASA-2021-0568.html
Type: security
CVE: CVE-2021-44854, CVE-2021-44855, CVE-2021-44856, CVE-2021-44857, CVE-2021-44858, CVE-2021-45038

Topics%20covered

Topics Covered

security advisory moderate unauthorized access XSS access control MediaWiki Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here