CVE-2021-29483: miraheze ManageWiki, изтичане на данни

Описание

Оригинално описание

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Засегнати продукти

• miraheze ManageWiki: < befb83c66f5b643e174897ea41a8a46679b26304

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в miraheze ManageWiki

• 4.4CVE-2025-43861
• 4.6CVE-2025-32964
• 8.0CVE-2025-32956
• 6.5CVE-2024-25109

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-29483
• https://nvd.nist.gov/vuln/detail/CVE-2021-29483
• https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv
• https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304
• https://phabricator.miraheze.org/T7213