The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mediawiki | Nov 4, 2022 | Dec 17, 2021 |
| Freebsd | — | Upgrade mediawiki136Upgrade mediawiki137Upgrade mediawiki135 | Nov 4, 2022 | Dec 21, 2021 |
| Gentoo Linux | — | Upgrade www-apps/mediawiki. | May 23, 2023 | Dec 17, 2021 |
| Mediawiki | — | Upgrade MediaWiki to the latest version | Dec 23, 2021 | Dec 17, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub