An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to catalog and enumerate any number of IP addresses related to these account creations.
Advisories
Source ID Title
EUVD EUVD EUVD-2021-18449 An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to catalog and enumerate any number of IP addresses related to these account creations.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-03T23:03:33.164Z

Reserved: 2021-04-22T00:00:00

Link: CVE-2021-31552

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-04-22T03:15:08.163

Modified: 2024-11-21T06:05:53.970

Link: CVE-2021-31552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.