VDB
CVE-2021-30159
CVE-2021-30159
PUBLISHED
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
EPSS 0.87% · 75.6th percentile
Risk Scores
EPSS Score
0.87%
75.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:25.10 | mediawiki | 0, *, 1:1.43.3+dfsg-1 |
| Ubuntu:20.04:LTS | mediawiki | 1:1.31.5-3ubuntu1, 1:1.31.6-1, 1:1.31.7-1 |
| Ubuntu:22.04:LTS | mediawiki | *, 1:1.35.4-1, 1:1.35.5-1 |
| Ubuntu:24.04:LTS | mediawiki | 1:1.39.7-1, 1:1.39.6-1, 1:1.39.5-1 |
Timeline
- Apr 9, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 6, 2021 EPSS Score
- Jun 11, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2021-30159 third-party-advisory
- https://phabricator.wikimedia.org/T272386 third-party-advisory
- https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html third-party-advisory
- https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/49ce7dd2143d01cffd4dfd2f2af79b2b93672eac%5E%21/ third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2021-30159 third-party-advisory