What is CVE-2021-45471?

CVE-2021-45471 is a medium-severity software vulnerability with a CVSS score of 5.3. In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.

Is CVE-2021-45471 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2021-45471 affect?

Tracked products affected include MediaWiki. Check the version you run to see whether it is affected.

How do I fix CVE-2021-45471?

Apply the vendor fix in your normal patch cycle. Upgrade affected products to a fixed version.

← All products

CVE-2021-45471

MEDIUM severity · CVSS 5.3

5.3CVSS MEDIUM

Summary

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products we track (1)

MediaWiki

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gerrit.wikimedia.org/r/q/Iac86cf63bd014ef99e83dccfce9b8942e15d2bf9Advisory
https://gerrit.wikimedia.org/r/q/Id9af124427bcd1e85301d2140a38bf47bbc5622cAdvisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/
https://phabricator.wikimedia.org/T296578Advisory