Description

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)

Remediation

References

CVE-2021-41801

Related Vulnerabilities

WordPress Plugin Flickr Justified Gallery Cross-Site Scripting (3.3.6)

WordPress Plugin Scout bazar Cross-Site Scripting (1.3.3)

LimeSurvey Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-20322)

WordPress 4.0.x PHP Object Injection (4.0 - 4.0.32)

WordPress Plugin Cooked-Recipe Cross-Site Scripting (1.7.9)

Severity

High

Classification

CVE-2021-41801 CWE-863 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities