CVE-2021-30152
published 2021-04-09CVE-2021-30152: An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
1.23%
65.8th percentile
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | mediawiki | < mediawiki 1:1.35.2-1 (bookworm) | mediawiki 1:1.35.2-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mediawiki | mediawiki | < 1.31.13 | 1.31.13 |
| mediawiki | mediawiki | >= 0 < 1:1.35.2-1 | 1:1.35.2-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.2-1 | 1:1.35.2-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.2-1 | 1:1.35.2-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.2-1 | 1:1.35.2-1 |
| mediawiki | mediawiki | >= 1.32.0 < 1.35.2 | 1.35.2 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2021-30152: mediawiki - An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x be...
vendor_debian·2021·CVSS 4.3
CVE-2021-30152 [MEDIUM] CVE-2021-30152: mediawiki - An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x be...
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
Scope: local
bookworm: resolved (fixed in 1:1.35.2-1)
bullseye: resolved (fixed in 1:1.35.2-1)
forky: resolved (fixed in 1:1.35.2-1)
sid: resolved (fixed in 1:1.35.2-1)
trixie: resolved (fixed in 1:1.35.2-1)
Red Hat
mediawiki: action=protect lets users with 'protect' permission protect to higher protection level
vendor_redhat·2020-12-22·CVSS 4.3
CVE-2021-30152 [MEDIUM] CWE-281 mediawiki: action=protect lets users with 'protect' permission protect to higher protection level
mediawiki: action=protect lets users with 'protect' permission protect to higher protection level
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
In mediawiki package when using API to protect a page, user with "protect" permission can protect the page to a higher level than they can edit.
Statement: The mediawiki package was removed from OpenShift Container Platform (OCP) in version 4.3, therefore for OCP 4 has been marked as out of support scope.
Package: mediawiki (Red Hat OpenShift Container Platform 3.11) - Will not fix
Package: mediawiki (Red Hat OpenShift Container Platform 4) - Out of supp
GHSA
GHSA-9q28-h7m9-gwr9: An issue was discovered in MediaWiki before 1
ghsa_unreviewed·2022-05-24
CVE-2021-30152 [MEDIUM] CWE-732 GHSA-9q28-h7m9-gwr9: An issue was discovered in MediaWiki before 1
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
OSV
CVE-2021-30152: An issue was discovered in MediaWiki before 1
osv·2021-04-09·CVSS 4.3
CVE-2021-30152 [MEDIUM] CVE-2021-30152: An issue was discovered in MediaWiki before 1
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2021/05/msg00003.htmlhttps://lists.debian.org/debian-lts-announce/2021/05/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/https://phabricator.wikimedia.org/T270713https://security.gentoo.org/glsa/202107-40https://www.debian.org/security/2021/dsa-4889https://lists.debian.org/debian-lts-announce/2021/05/msg00003.htmlhttps://lists.debian.org/debian-lts-announce/2021/05/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/https://phabricator.wikimedia.org/T270713https://security.gentoo.org/glsa/202107-40https://www.debian.org/security/2021/dsa-4889
2021-04-09
Published