CVE-2021-45038
Publication date 17 December 2021
Last updated 24 July 2024
Ubuntu priority
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mediawiki | 22.04 LTS jammy |
Not affected
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Not affected
|
Notes
sbeattie
include upstream dda5355c0ee804c94ff371a8a16c4a2a8e4436bd as a prerequisite to the fix for this CVE to make it apply more cleanly. introduced in 0a8403271109 (v1.33.0)
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.3 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |