The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked     after submitting a replace job, the job is still run, even if it may be run at a later time (due to the     job queue backlog) (CVE-2021-41801)

Note that Nessus relies on the presence of the package as reported by the vendor.

MediaWiki reports :

(T285515, CVE-2021-41798) SECURITY: XSS vulnerability in Special:Search.

(T290379, CVE-2021-41799) SECURITY: ApiQueryBacklinks can cause a full table scan.

(T284419, CVE-2021-41800) SECURITY: fix PoolCounter protection of Special:Contributions.

(T279090, CVE-2021-41801) SECURITY: ReplaceText continues performing actions if the user no longer has the correct permission (such as by being blocked).

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4979 advisory.

    Multiple security issues were found in MediaWiki, a website engine for collaborative work, which could     result in cross-site scripting, denial of service and a bypass of restrictions in the Replace Text     extension. For the oldstable distribution (buster), these problems have been fixed in version     1:1.31.16-1~deb10u1. For the stable distribution (bullseye), these problems have been fixed in version     1:1.35.4-1~deb11u1. We recommend that you upgrade your mediawiki packages. For the detailed security     status of mediawiki please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/mediawiki

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
245517	Linux Distros Unpatched Vulnerability : CVE-2021-41801	Nessus	Misc.	high
153872	FreeBSD : mediawiki -- multiple vulnerabilities (f84ab297-2285-11ec-9e79-08002789875b)	Nessus	FreeBSD Local Security Checks	high
153862	Debian DSA-4979-1 : mediawiki - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-41801

high

Tenable Plugins

high

high

high