CVE-2021-30159

 

Published at: - 09-04-2021 09:15

Last modified: - 27-05-2022 09:05

Total changes: - 10

Description

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

 

Verification logic

 

Reference

• https://phabricator.wikimedia.org/T272386
• DSA-4889-Third Party Advisory
• FEDORA-2021-f4223b6684-Mailing List, Third Party Advisory
• FEDORA-2021-d298103d3a-Mailing List, Third Party Advisory
• [debian-lts-announce] 20210505 [SECURITY] [DLA 2648-1] mediawiki security update-Third Party Advisory
• [debian-lts-announce] 20210506 [SECURITY] [DLA 2648-2] mediawiki regression update-Mailing List, Third Party Advisory
• GLSA-202107-40-Third Party Advisory

 

Keywords

NVD

 

CVE-2021-30159

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures