CVE-2021-31554

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created MediaWiki user accounts, thus allowing nefarious users to remain unblocked.

• CWE-863

• https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48Issue Tracking, Vendor Advisory
• https://phabricator.wikimedia.org/T272244Third Party Advisory
• https://gerrit.wikimedia.org/r/q/Ie1f4333d5b1c9d17fb2236fe38a31de427a4cc48Issue Tracking, Vendor Advisory
• https://phabricator.wikimedia.org/T272244Third Party Advisory

Published

Apr 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31549An issue was discovered in the AbuseFilter extension for Med…4.3
• CVE-2021-3155snapd 2.54.2 and earlier created ~/snap directories in user …5.5
• CVE-2021-31550An issue was discovered in the CommentBox extension for Medi…5.4
• CVE-2021-31551An issue was discovered in the PageForms extension for Media…6.1
• CVE-2021-31552An issue was discovered in the AbuseFilter extension for Med…5.4
• CVE-2021-31553An issue was discovered in the CheckUser extension for Media…6.5
• CVE-2021-31555An issue was discovered in the Oauth extension for MediaWiki…7.5
• CVE-2021-31556An issue was discovered in the Oauth extension for MediaWiki…9.8
• CVE-2021-31558DIAEnergie Version 1.7.5 and prior is vulnerable to stored c…6.1
• CVE-2021-31559A crafted request bypasses S2S TCP Token authentication writ…7.5
• CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can re…7.8
• CVE-2021-31562The SSL/TLS configuration of Fresenius Kabi Agilia Link + ve…9.1