An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.

The remote host is affected by the vulnerability described in GLSA-202107-40 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The patch from latest upstream release to address CVE-2021-30152 was not portable to stretch-security version causing MediaWiki APIs to fail. This update includes a patch from upstream REL_31 release which fix the issue. 

For Debian 9 stretch, this problem has been fixed in version 1:1.27.7-1~deb9u9.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in MediaWiki, a website engine for collaborative work, which could result in incomplete page/blocking protection, denial of service or cross-site scripting.

ID	Name	Product	Family	Severity
156986	GLSA-202107-40 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
149344	Debian DLA-2648-2 : mediawiki regression update	Nessus	Debian Local Security Checks	medium
148441	Debian DSA-4889-1 : mediawiki - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-30155

medium

Tenable Plugins

high

medium

medium