CVE-2021-45038
Publication date 17 December 2021
Last updated 25 August 2025
Ubuntu priority
Description
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mediawiki | 22.04 LTS jammy |
Not affected
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Not affected
|
Notes
sbeattie
include upstream dda5355c0ee804c94ff371a8a16c4a2a8e4436bd as a prerequisite to the fix for this CVE to make it apply more cleanly. introduced in 0a8403271109 (v1.33.0)
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.3 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |