CVE-2021-44857

—

CVSS 3.1

6.5 medium

EPSS

<1%p57

Published

Dec 17, 2021 (Dec 17, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.

Vendors: mediawiki
Products: mediawiki
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.