MediaWiki up to 1.35.4/1.36.2/1.37.0 Special:ChangeContentModel EditFilterMergedContent return value

Summaryinfo

A vulnerability was found in MediaWiki up to 1.35.4/1.36.2/1.37.0. It has been classified as problematic. This affects the function EditFilterMergedContent of the component Special:ChangeContentModel. This manipulation causes return value. This vulnerability appears as CVE-2021-44856. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in MediaWiki up to 1.35.4/1.36.2/1.37.0 (Content Management System) and classified as problematic. Affected by this vulnerability is the function EditFilterMergedContent of the component Special:ChangeContentModel. The manipulation with an unknown input leads to a return value vulnerability. The CWE definition for the vulnerability is CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. As an impact it is known to affect integrity, and availability. The summary by CVE is:

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value.

The weakness was presented 12/26/2022. It is possible to read the advisory at phabricator.wikimedia.org. This vulnerability is known as CVE-2021-44856 since 12/13/2021. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.35.5, 1.36.3 or 1.37.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MediaWiki

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.35.0
• 1.35.1
• 1.35.2
• 1.35.3
• 1.35.4
• 1.36
• 1.36.0
• 1.36.1
• 1.36.2
• 1.37.0

License

• open-source

Website

• Product: https://www.mediawiki.org/wiki/MediaWiki

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion