Description

An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppressed MediaWiki user, were different than for any other user, thus easily disclosing suppressed accounts (which are supposed to be completely hidden).

Remediation

References

CVE-2021-36127

Related Vulnerabilities

WordPress Plugin Track That Stat 'data' Parameter Cross-Site Scripting (1.0.8)

WordPress Plugin CAC Featured Content TimThumb Arbitrary File Upload (0.8)

WordPress Plugin Video Player for YouTube Cross-Site Scripting (1.3)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-31049)

WordPress Plugin Duplicate Post SQL Injection (1.1.9)

Severity

Medium

Classification

CVE-2021-36127 CWE-922 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities