by Kastro
Paper/Archive/CVE-2021-29483

CVE-2021-29483

miraheze ManageWiki — wikiconfig API leaked private config variables set through ManageWiki

EPSS 1%CVSS 9.4
critical.is priorityof 100
42
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 68.5.685 × 2013.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Affected

ProductAffectedFixed inSource
ManageWiki< befb83c66f5b643e174897ea41a8a46679b26304–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

References

refgithub.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vvrefgithub.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304refphabricator.miraheze.org/T7213