CVE-2021-30159

NameCVE-2021-30159
DescriptionAn issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2648-1, DSA-4889-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mediawiki (PTS)stretch1:1.27.7-1~deb9u3vulnerable
stretch (security)1:1.27.7-1~deb9u9fixed
buster1:1.31.12-1~deb10u1vulnerable
buster (security)1:1.31.14-1~deb10u1fixed
bullseye, sid1:1.35.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mediawikisourcestretch1:1.27.7-1~deb9u8DLA-2648-1
mediawikisourcebuster1:1.31.14-1~deb10u1DSA-4889-1
mediawikisource(unstable)1:1.35.2-1

Notes

https://phabricator.wikimedia.org/T272386
https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html

Search for package or bug name: Reporting problems