CVE-2021-29483 - OpenCVE

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Miraheze	Managewiki

Configuration 1 [-]

cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304
https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv
https://phabricator.miraheze.org/T7213

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-04-28T21:25:13

Updated: 2024-08-03T22:11:05.326Z

Reserved: 2021-03-30T00:00:00

Link: CVE-2021-29483

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-04-28T22:15:08.337

Modified: 2021-05-08T02:26:35.107

Link: CVE-2021-29483

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "ManageWiki", "vendor": "miraheze", "versions": [{"status": "affected", "version": "< befb83c66f5b643e174897ea41a8a46679b26304"}]}], "descriptions": [{"lang": "en", "value": "ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "{\"CWE-200\":\"Exposure of Sensitive Information to an Unauthorized Actor\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-28T21:25:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304"}, {"tags": ["x_refsource_MISC"], "url": "https://phabricator.miraheze.org/T7213"}], "source": {"advisory": "GHSA-jmc9-rv2f-g8vv", "discovery": "UNKNOWN"}, "title": "wikiconfig API leaked private config variables set through ManageWiki", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-29483", "STATE": "PUBLIC", "TITLE": "wikiconfig API leaked private config variables set through ManageWiki"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ManageWiki", "version": {"version_data": [{"version_value": "< befb83c66f5b643e174897ea41a8a46679b26304"}]}}]}, "vendor_name": "miraheze"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-200\":\"Exposure of Sensitive Information to an Unauthorized Actor\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv", "refsource": "CONFIRM", "url": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv"}, {"name": "https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304", "refsource": "MISC", "url": "https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304"}, {"name": "https://phabricator.miraheze.org/T7213", "refsource": "MISC", "url": "https://phabricator.miraheze.org/T7213"}]}, "source": {"advisory": "GHSA-jmc9-rv2f-g8vv", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T22:11:05.326Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://phabricator.miraheze.org/T7213"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-29483", "datePublished": "2021-04-28T21:25:13", "dateReserved": "2021-03-30T00:00:00", "dateUpdated": "2024-08-03T22:11:05.326Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "07A8635C-1EE6-41CA-811E-99AFAE1D7F5F", "versionEndExcluding": "2021-04-28", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround."}, {"lang": "es", "value": "ManageWiki es una extensi\u00f3n del proyecto MediaWiki. La API \"wikiconfig\" filtr\u00f3 el valor de las variables de configuraci\u00f3n privadas establecidas por medio de la variable ManageWiki a todos los usuarios. Esto ha sido parcheado por https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. Si no puede parchear, configure `$ wgAPIListModules ['wikiconfig'] = 'ApiQueryDisabled';` o elimine la configuraci\u00f3n privada como soluci\u00f3n alternativa"}], "id": "CVE-2021-29483", "lastModified": "2021-05-08T02:26:35.107", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-04-28T22:15:08.337", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://phabricator.miraheze.org/T7213"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Primary"}]}