CVE-2021-29483

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294846.8Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access CVE-2021-294858.8Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE)CVE-2021-294867.5cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data CVE-2021-294877.4octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit CVE-2021-294885.3SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function CVE-2021-294895.4Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not syste CVE-2021-294905.8Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to CVE-2021-294928.3Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versio CVE-2021-294938.8Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit all CVE-2021-294957.5Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verifi CVE-2021-294997.5SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce pre CVE-2021-295007.5bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there i