An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using     the MediaWiki API to protect a page, a user is currently able to protect to a higher level than they     currently have permissions for. (CVE-2021-30152)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-40 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The patch from latest upstream release to address CVE-2021-30152 was not portable to stretch-security version causing MediaWiki APIs to fail. This update includes a patch from upstream REL_31 release which fix the issue. 

For Debian 9 stretch, this problem has been fixed in version 1:1.27.7-1~deb9u9.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were found in MediaWiki, a website engine for collaborative work, which could result in incomplete page/blocking protection, denial of service or cross-site scripting.

ID	Name	Product	Family	Severity
245646	Linux Distros Unpatched Vulnerability : CVE-2021-30152	Nessus	Misc.	medium
156986	GLSA-202107-40 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
149344	Debian DLA-2648-2 : mediawiki regression update	Nessus	Debian Local Security Checks	medium
148441	Debian DSA-4889-1 : mediawiki - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-30152

medium

Tenable Plugins

medium

high

medium

medium