CVE-2021-31553

{"id": "CVE-2021-31553", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2021-04-22T03:15:08.197", "references": [{"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666963", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/666964", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667023", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667024", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667025", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/667027", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://phabricator.wikimedia.org/T275669", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could turn off Special:CheckUserLog and thus interfere with usage tracking."}, {"lang": "es", "value": "Se detect\u00f3 un problema en la extensi\u00f3n CheckUser para MediaWiki versiones hasta 1.35.2. Unos nombres de usuario de MediaWiki con espacios en blanco al final podr\u00edan ser almacenados en la tabla de la base de datos cu_log de manera que se produjera una denegaci\u00f3n de servicio para determinadas p\u00e1ginas de extensi\u00f3n y funcionalidad CheckUser. Por ejemplo, el atacante podr\u00eda desactivar Special: CheckUserLog y as\u00ed interferir con el seguimiento del uso"}], "lastModified": "2021-04-22T20:14:45.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4067807D-769C-485F-A7E3-EE96885BDCE7", "versionEndIncluding": "1.35.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}