CVE-2021-46147: CSRF
Published Jan 7, 2022
·Updated
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
Affected Software
3 affected components
MediaWiki MediaWiki<1.35.5
MediaWiki MediaWiki>=1.36.0<1.36.3
MediaWiki MediaWiki>=1.37.0<1.37.1
Event History
Jan 7, 2022
CVE Published
via MITRE·05:54 AM
Data Sourced
via MITRE·05:54 AM
Description
Jan 10, 2022
Data Sourced
via NVD·02:11 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-46147.
2
What is the severity of CVE-2021-46147?
The severity of CVE-2021-46147 is high with a CVSS score of 8.8.
3
What is the affected software?
The affected software is MediaWiki versions before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
4
What does CVE-2021-46147 allow?
CVE-2021-46147 allows CSRF (Cross-Site Request Forgery) attacks through the MassEditRegex feature in MediaWiki.
5
Are there any available references for CVE-2021-46147?
Yes, you can find references for CVE-2021-46147 at the following links: [1](https://gerrit.wikimedia.org/r/q/I5980de35b0a01b5242b68b7b0bdc08adf5d968d8) and [2](https://phabricator.wikimedia.org/T293341).