CVE-2021-35197

In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).

• CWE-863

• https://lists.debian.org/debian-lts-announce/2021/10/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
• https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/
• https://phabricator.wikimedia.org/T280226Exploit, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4979Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/10/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
• https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/
• https://phabricator.wikimedia.org/T280226Exploit, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4979Third Party Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3516There's a flaw in libxml2's xmllint in versions before 2.9.1…7.8
• CVE-2021-3517There is a flaw in the xml entity encoding functionality of …8.6
• CVE-2021-3518There's a flaw in libxml2 in versions before 2.9.11. An atta…8.8
• CVE-2021-3519A vulnerability was reported in some Lenovo Desktop models t…6.8
• CVE-2021-35193Patterson Application Service in Patterson Eaglesoft 18 thro…7.5
• CVE-2021-35196Manuskript through 0.12.0 allows remote attackers to execute…7.8
• CVE-2021-35198NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stor…5.4
• CVE-2021-35199NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stor…5.4
• CVE-2021-3520There's a flaw in lz4. An attacker who submits a crafted fil…9.8
• CVE-2021-35200NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged …4.8
• CVE-2021-35201NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML Exter…6.5
• CVE-2021-35202NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authoriz…4.3