CVE-2021-30159

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.

• https://lists.debian.org/debian-lts-announce/2021/05/msg00003.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00006.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
• https://phabricator.wikimedia.org/T272386Exploit, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4889Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00003.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00006.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
• https://phabricator.wikimedia.org/T272386Exploit, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4889Third Party Advisory

Published

Apr 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30153An issue was discovered in the VisualEditor extension in Med…4.3
• CVE-2021-30154An issue was discovered in MediaWiki before 1.31.12 and 1.32…6.1
• CVE-2021-30155An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30156An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30157An issue was discovered in MediaWiki before 1.31.12 and 1.32…6.1
• CVE-2021-30158An issue was discovered in MediaWiki before 1.31.12 and 1.32…5.3
• CVE-2021-30161An issue was discovered on LG mobile devices with Android OS…5.5
• CVE-2021-30162An issue was discovered on LG mobile devices with Android OS…7.1
• CVE-2021-30163Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers…7.5
• CVE-2021-30164Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers…9.8
• CVE-2021-30165The default administrator account & password of the EDIMAX w…8.1
• CVE-2021-30166The NTP Server configuration function of the IP camera devic…7.2