CVE-2021-30153

State: Published
Severity: 4.3 Medium
Published: Apr 15, 2023
Updated: Feb 6, 2025
Reserved: Apr 6, 2021

Description

An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://phabricator.wikimedia.org/T270453
https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html
https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.