CVE-2021-29483: wikiconfig API leaked private config variables set through ManageWiki
ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set $wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled'; or remove private config as a workaround.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29483?
CVE-2021-29483 is classified as a medium-severity vulnerability due to its potential to disclose sensitive information.
How do I fix CVE-2021-29483?
To fix CVE-2021-29483, update the Miraheze ManageWiki extension to the latest version after the patch was applied.
What does CVE-2021-29483 affect?
CVE-2021-29483 affects versions of the Miraheze ManageWiki extension prior to April 28, 2021.
Who is impacted by CVE-2021-29483?
All users of the affected versions of the ManageWiki extension could be impacted by the leak of private configuration variables.
What was the cause of CVE-2021-29483?
CVE-2021-29483 was caused by the 'wikiconfig' API leaking private configuration variables to all users.