CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)

References

Affected packages

Git / github.com/wikimedia/mediawiki

Affected ranges

Type

GIT

Repo

https://github.com/wikimedia/mediawiki

Events

Introduced

Fixed

8d00acfb43e9bd03ba7711126b03e9e6eaa918d5

Introduced

9b8a1684d4a81d1e617bfb7c9b39a347fc454b53

Fixed

4a3d6a63f4656877f454f050355ee565b97f40f4

Introduced

bc542ec6d8573dfb906b468901799e0017875f1e

Fixed

f65f9d6971578b301ef9fc915a729e6a13266a5e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.31.16"
        },
        {
            "introduced": "1.35.0"
        },
        {
            "fixed": "1.35.4"
        },
        {
            "introduced": "1.36.0"
        },
        {
            "fixed": "1.36.2"
        }
    ]
}

Affected versions

1.*

1.1.0

1.3.0beta1

1.31.0

1.31.0-rc.0

1.31.0-rc.1

1.31.0-rc.2

1.31.1

1.31.10

1.31.11

1.31.12

1.31.13

1.31.14

1.31.15

1.31.2

1.31.3

1.31.4

1.31.5

1.31.6

1.31.7

1.31.8

1.31.9

1.35.0

1.35.1

1.35.2

1.35.3

1.36.0

1.36.1

1.5.0alpha1

1.5.0alpha2

1.5.0beta1

1.5.0beta2

1.5.0beta3

1.5.0beta4

1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41801.json"