Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31547PUBLISHED: 2021-04-22An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
CVE-2021-31548PUBLISHED: 2021-04-22An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
CVE-2021-31549PUBLISHED: 2021-04-22An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.
CVE-2021-31550PUBLISHED: 2021-04-22An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
CVE-2021-31551PUBLISHED: 2021-04-22An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.
0 Comments
Tweet This
User Rank: Author
8/13/2020 | 7:00:16 PM
The likelihood of there being an actual drop is very low. Please remember that it is often 3-6 months or more before a breach is even found. This is very complicated when you look at the reality of the last 6 months for IT teams. Their job has been 100% focused on keeping companies operating. Many security functions have simply not been kept up with.
You should expect to see a much larger than normal increase in the second half of the year.
Thanks for keeping people in the know on what is happening with your article by the way.