MediaWiki up to 1.36 CentralAuth Extension improper authentication

Summaryinfo

A vulnerability was found in MediaWiki up to 1.36. It has been declared as critical. The impacted element is an unknown function of the component CentralAuth Extension. Such manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2021-36128. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in MediaWiki up to 1.36 (Content Management System). Affected by this issue is some unknown processing of the component CentralAuth Extension. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. The impact remains unknown.

The weakness was disclosed 07/03/2021. The advisory is shared for download at phabricator.wikimedia.org. This vulnerability is handled as CVE-2021-36128. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MediaWiki

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36

License

• open-source

Website

• Product: https://www.mediawiki.org/wiki/MediaWiki

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion