What’s Vulnerable › Vulnerabilities

CVE-2021-30153

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-15 · updated 2026-06-17
• Weakness: CWE-668

Description

An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

Affected products

• Wikimedia Foundation MediaWiki: before 1.31.13; from 1.32.0 before 1.35.2 — fixed in 1.31.13, 1.35.2

How to fix

Upgrade to a fixed version: Wikimedia Foundation MediaWiki 1.31.13, 1.35.2. Check the vendor advisory for mitigations.

References

• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
• https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html
• https://phabricator.wikimedia.org/T270453
• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
• https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.html
• https://phabricator.wikimedia.org/T270453

Get alerted when CVE-2021-30153 or the next vulnerability affects your stack