CVE-2021-30159

Katalog CVE

CVSS 4.3 · Medium EPSS 1,5%

Kerentanan pada mediawiki, debian linux +1 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.

Rincian

Terbit di NVD

9 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://phabricator.wikimedia.org/T272386 exploit · patch · advisory vendor
• https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202107-40 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4889 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOC...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBO...