An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mediawiki | Dec 17, 2021 | Dec 17, 2021 |
| Freebsd | — | Upgrade mediawiki135Upgrade mediawiki136Upgrade mediawiki137 | Nov 4, 2022 | Dec 21, 2021 |
| Gentoo Linux | — | Upgrade www-apps/mediawiki. | May 23, 2023 | Dec 20, 2021 |
| Mediawiki | — | Upgrade MediaWiki to the latest version | Jan 4, 2022 | Dec 20, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 20, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub