Bug 2036698 (CVE-2021-44858)

Summary: CVE-2021-44858 mediawiki: information disclosure
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aos-bugs, axel.thimm, bmontgom, eparis, jburrell, jokerman, mike, nstielau, puiterwijk, shurley, sponnaga
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mediawiki 1.35.5, mediawiki 1.36.3, mediawiki 1.37.1 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in mediawiki. The "undo" feature (action=edit&undo=##&undoafter=###) allowed an attacker to view the contents of arbitrary revisions, regardless of whether they had permissions to do so. This was also found in the "mcrundo" and "mcrrestore" actions (action=mcrundo and action=mcrrestore).
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-01-07 16:11:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2036699    
Bug Blocks: 2036706    

Description Marian Rehak 2022-01-03 15:51:02 UTC
It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.

Upstream Reference:

https://www.mediawiki.org/wiki/2021-12_security_release/FAQ

Comment 1 Marian Rehak 2022-01-03 15:51:16 UTC
Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 2036699]

Comment 2 Product Security DevOps Team 2022-01-07 16:11:02 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-44858