1. Home
  2. CVE Database
  3. CVE-2021-36129
MEDIUM · 4.3

CVE-2021-36129

An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus a...

Vulnerability Description

An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
MediawikiMediawiki<= 1.36

Related Weaknesses (CWE)

CWE-732

References

FAQ

What is CVE-2021-36129?

CVE-2021-36129 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus a...

How severe is CVE-2021-36129?

CVE-2021-36129 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-36129?

Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki.