Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2021-29483

wikiconfig API leaked private config variables set through ManageWiki

Description

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

miraheze ManageWiki

  • < befb83c66f5b643e174897ea41a8a46679b26304affected

References