CVE-2021-36132

An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variable, it might not validate all appropriate user rights, thus allowing a user with insufficient rights to perform operations (specifically file uploads) that they should not be allowed to perform.

• CWE-863

• https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T280590Exploit, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/r/q/I8ff2a67abd2c118a3469e4410eac2a451bfa76c3Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T280590Exploit, Patch, Vendor Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36127An issue was discovered in the CentralAuth extension in Medi…4.3
• CVE-2021-36128An issue was discovered in the CentralAuth extension in Medi…9.8
• CVE-2021-36129An issue was discovered in the Translate extension in MediaW…4.3
• CVE-2021-3613OpenVPN Connect 3.2.0 through 3.3.0 allows local users to lo…7.8
• CVE-2021-36130An XSS issue was discovered in the SocialProfile extension i…4.8
• CVE-2021-36131An XSS issue was discovered in the SportsTeams extension in …4.8
• CVE-2021-36133The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks secur…7.1
• CVE-2021-36134Out of bounds write vulnerability in the JPEG parsing code o…6.5
• CVE-2021-3614A vulnerability was reported on some Lenovo Notebook systems…6.8
• CVE-2021-36143ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NU…7.5
• CVE-2021-36144The polling timer handler in ACRN before 2.5 has a use-after…7.5
• CVE-2021-36145The Device Model in ACRN through 2.5 has a devicemodel/core/…7.5