Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2021-30153

Date: April 14, 2023

An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

Language: JS

Severity Score

Related Resources (9)

https://security.archlinux.org/CVE-2021-30153
https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html
https://phabricator.wikimedia.org/T270453
https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
https://github.com/wikimedia/mediawiki-extensions-VisualEditor/commit/1b34b59aa72b6cad2eb2b4c622828b08db9aa7ef
https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
https://nvd.nist.gov/vuln/detail/CVE-2021-30153
https://security-tracker.debian.org/tracker/CVE-2021-30153
https://www.mend.io/vulnerability-database/CVE-2021-30153

Severity Score

Weakness Type (CWE)

Exposure of Resource to Wrong Sphere

CWE-668

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us