CVE-2021-31552

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after account creation. Such rules would allow for user accounts to be created while blocking only the IP address used to create an account (and not the user account itself). Such rules could also be used by a nefarious, unprivileged user to catalog and enumerate any number of IP addresses related to these account creations.

• CWE-863

• https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d0190335363ac2decf28e4313da1Issue Tracking, Vendor Advisory
• https://phabricator.wikimedia.org/T152394Third Party Advisory
• https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d0190335363ac2decf28e4313da1Issue Tracking, Vendor Advisory
• https://phabricator.wikimedia.org/T152394Third Party Advisory

Published

Apr 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31547An issue was discovered in the AbuseFilter extension for Med…4.3
• CVE-2021-31548An issue was discovered in the AbuseFilter extension for Med…6.5
• CVE-2021-31549An issue was discovered in the AbuseFilter extension for Med…4.3
• CVE-2021-3155snapd 2.54.2 and earlier created ~/snap directories in user …5.5
• CVE-2021-31550An issue was discovered in the CommentBox extension for Medi…5.4
• CVE-2021-31551An issue was discovered in the PageForms extension for Media…6.1
• CVE-2021-31553An issue was discovered in the CheckUser extension for Media…6.5
• CVE-2021-31554An issue was discovered in the AbuseFilter extension for Med…5.4
• CVE-2021-31555An issue was discovered in the Oauth extension for MediaWiki…7.5
• CVE-2021-31556An issue was discovered in the Oauth extension for MediaWiki…9.8
• CVE-2021-31558DIAEnergie Version 1.7.5 and prior is vulnerable to stored c…6.1
• CVE-2021-31559A crafted request bypasses S2S TCP Token authentication writ…7.5