CVE-2021-30159

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-301615.5An issue was discovered on LG mobile devices with Android OS 11 software. Attackers can bypass the lockscreen protection mechanism after an CVE-2021-301627.1An issue was discovered on LG mobile devices with Android OS 4.4 through 11 software. Attackers can leverage ISMS services to bypass access CVE-2021-301637.5Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that h CVE-2021-301649.8Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues A CVE-2021-301658.1The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware CVE-2021-301667.2The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a comman CVE-2021-301679.8The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL parameters and furth CVE-2021-301689.8The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant administrator’s credential CVE-2021-301697.5The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s credential.CVE-2021-30177.5The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the CVE-2021-301705.4Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject CVE-2021-301715.4Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious Ja