VulnerabilityModified
CVE-2021-31553
MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality.
MEDIUM 6.5EPSS 1.40%
Does this matter?
Lower severity and a low EPSS score (1.40%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 1.40% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-428
- Affected
- mediawiki/mediawiki
- Source
- cve@mitre.org
References
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667024Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667025Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667027Issue Tracking, Third Party Advisory
- https://phabricator.wikimedia.org/T275669Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667024Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667025Issue Tracking, Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667027Issue Tracking, Third Party Advisory
- https://phabricator.wikimedia.org/T275669Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.