An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.31.12 or 1.32.x prior to 1.35.2. It is, therefore, affected by a vulnerability in Special:Contributions that can leak that hidden users exist.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.36. It is, therefore, affected by a flaw when the blocker message is invalid in the content language, but also English is invalid on the wiki, which may permit remote attackers to bypass restrictions against abusive users.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113998	MediaWiki 1.32.x < 1.35.2 Special Contributions Hidden User Leakage	Web App Scanning	Component Vulnerability	critical
113997	MediaWiki < 1.31.12 Special Contributions Hidden User Leakage	Web App Scanning	Component Vulnerability	critical
113994	MediaWiki < 1.36.0 Invalid MediaWiki Abusefilter-blocker Breaks Filters	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2021-36126

critical

Tenable Plugins

critical

critical

critical