CVE-2021-41801

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2021-10-11

Last modified

2024-08-04

Affected products

• Mediawiki (Mediawiki)

References

• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
• https://phabricator.wikimedia.org/T279090