High severity · published Apr 28, 2021
CVE-2021-29483
ManageWiki is an extension to the MediaWiki project
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Managewiki · Miraheze
before 2021-04-28 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29483
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29483
Patch
https://github.com/miraheze/ManageWiki/commit/befb83c66f5b643e174897ea41a8a46679b26304
Mitigation
https://github.com/miraheze/ManageWiki/security/advisories/GHSA-jmc9-rv2f-g8vv
Issue Tracking
https://phabricator.miraheze.org/T7213
More from Managewiki
8.0
CVE-2025-32956
ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
5.4
CVE-2025-43861
ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
5.4
CVE-2024-25109
ManageWiki is a MediaWiki extension allowing users to manage wikis
4.6
CVE-2025-32964
ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions