In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).

The remote host is affected by the vulnerability described in GLSA-202107-40 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2779 advisory.

  - In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have     certain unintended API access. When a bot account has a sitewide block applied, it is able to still     purge pages through the MediaWiki Action API (which a sitewide block should have prevented).
    (CVE-2021-35197)

  - MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on     the Special:Search results page. (CVE-2021-41798)

  - MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query     processing time). ApiQueryBacklinks (action=query&list;=backlinks) can cause a full table scan.
    (CVE-2021-41799)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4979 advisory.

  - In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have     certain unintended API access. When a bot account has a sitewide block applied, it is able to still     purge pages through the MediaWiki Action API (which a sitewide block should have prevented).
    (CVE-2021-35197)

  - MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on     the Special:Search results page. (CVE-2021-41798)

  - MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query     processing time). ApiQueryBacklinks (action=query&list;=backlinks) can cause a full table scan.
    (CVE-2021-41799)

  - MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query     processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because     PoolCounter protection is mishandled. (CVE-2021-41800)

  - The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked     after submitting a replace job, the job is still run, even if it may be run at a later time (due to the     job queue backlog) (CVE-2021-41801)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
156986	GLSA-202107-40 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
153966	Debian DLA-2779-1 : mediawiki - LTS security update	Nessus	Debian Local Security Checks	high
153862	Debian DSA-4979-1 : mediawiki - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-35197

high

Tenable Plugins

high

high

high