CVE-2021-36126

An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36

published July 2, 2021

CVSS
—
EPSS
1%
Percentile
68.0
In the wild
Unconfirmed
What it is

⚠️ A little mix-up in the AbuseFilter extension could lead to fatal errors! When language settings aren’t quite right, it may not block that pesky user trying to wreak havoc. 😱 Think of it like a bouncer at a club who suddenly forgets the guest list and just assumes everyone’s name is ‘John’ — if someone slips in without a proper check, chaos could ensue! If the fallback English message fails, the system might just throw a fatal error instead of blocking unwanted users. This could leave your wiki vulnerable to spam or harmful edits, making it a playground for those with bad intentions!

Put simply

Think of it like a bouncer at a club who suddenly forgets the guest list and just assumes everyone’s name is ‘John’ — if someone slips in without a proper check, chaos could ensue! This vulnerability occurs in the AbuseFilter extension of MediaWiki when an invalid content language message causes the system to revert to an English version that might also be invalid, leading to a failure in blocking malicious users.

What to do

If the fallback English message fails, the system might just throw a fatal error instead of blocking unwanted users. This could leave your wiki vulnerable to spam or harmful edits, making it a playground for those with bad intentions! To address this, ensure you update to the latest version of MediaWiki where this issue is patched. Regularly check your language settings and AbuseFilter configurations to avoid future mishaps. You've got this! With a few steps, you can keep your wiki safe and secure. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01201 · 68.0th percentile
Published
2021-07-02T13:01Z
EPSS history
Timeline
  • 02 JUL 13:01Z
    An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36
    cvelistv5