Critical · published April 28, 2021
🚨 A sneaky API leak is spilling sensitive configuration data to all users! 😱 Think of it like a restaurant's secret recipe book left wide open on the counter — anyone can take a peek at the ingredients no matter their status. Your private settings shouldn’t be that accessible! An attacker could easily access private configuration variables, potentially exposing sensitive information about how your MediaWiki is set up. This could lead to unauthorized changes or simply give malicious actors the knowledge they need to cause harm. It’s absolutely devastating for your site's security and privacy! 🔥
Think of it like a restaurant's secret recipe book left wide open on the counter — anyone can take a peek at the ingredients no matter their status. Your private settings shouldn’t be that accessible! The 'wikiconfig' API in ManageWiki inadvertently reveals private configuration values to all users, allowing anyone with access to the API to view potentially sensitive settings.
An attacker could easily access private configuration variables, potentially exposing sensitive information about how your MediaWiki is set up. This could lead to unauthorized changes or simply give malicious actors the knowledge they need to cause harm. It’s absolutely devastating for your site's security and privacy! 🔥 Patch your ManageWiki extension to the latest version immediately using the provided patch. If you can't patch right away, set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` to restrict access or remove any private config variables. Don't wait! You've got this! Secure your setup and keep your wiki safe! 🛡️