CVE-2021-21275: CSRF in MediaWiki Report extension
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-21275?
CVE-2021-21275 is a Cross-Site Request Forgery (CSRF) vulnerability in the MediaWiki Report extension.
What is the severity of CVE-2021-21275?
CVE-2021-21275 has a severity value of 4.3, which is considered medium.
How does CVE-2021-21275 affect the Report extension of MediaWiki?
CVE-2021-21275 allows forged requests to be made to report a revision through the Special:Report feature in MediaWiki before the fix.
Has CVE-2021-21275 been fixed?
Yes, CVE-2021-21275 has been fixed in commit f828dc6 of the Report extension in MediaWiki.
Where can I find more information about CVE-2021-21275?
You can find more information about CVE-2021-21275 in the provided references: [Link 1](https://github.com/Kenny2github/Report/commit/f828dc6f73cdfaea5639edbf8ac7b326eeefb117), [Link 2](https://github.com/Kenny2github/Report/security/advisories/GHSA-9f3w-c334-jm2h), [Link 3](https://www.oracle.com//security-alerts/cpujul2021.html).