CVE-2021-21275

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 60.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Kenny2github ReportReport Project ReportOracle Communications Cloud Native Core Network Slice Selection Function+1 more
Timeline
PublishedJan 25
Latest updateApr 15

Description

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5kenny2github/report< f828dc6
▶NVDreport_project/report< 2021-01-21
▶NVDoracle/communications_pricing_design_center12.0.0.4.0, 12.0.0.5.0+1

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
CSRF in MediaWiki Report extension↗2021-01-25
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Communications Applications Risk Matrix: REST Service Manager (Jacoco) — CVE-2021-21275↗2022-04-15
▶