Medium severity4.3NVD Advisory· Published Apr 9, 2021· Updated Jun 17, 2026
CVE-2021-30159
CVE-2021-30159
Description
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certain "fast double move" situations. MovePage::isValidMoveTarget() uses FOR UPDATE, but it's only called if Title::getArticleID() returns non-zero with no special flags. Next, MovePage::moveToInternal() will delete the page if getArticleID(READ_LATEST) is non-zero. Therefore, if the page is missing in the replica DB, isValidMove() will return true, and then moveToInternal() will unconditionally delete the page if it can be found in the master.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- MediaWiki/MediaWikidescription
- Range: <1.31.12, 1.32.x through 1.35.x before 1.35.2
Patches
Vulnerability mechanics
References
7- phabricator.wikimedia.org/T272386nvdExploitPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2021/05/msg00003.htmlnvdThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/05/msg00006.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/202107-40nvdThird Party Advisory
- www.debian.org/security/2021/dsa-4889nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/nvd
News mentions
0No linked articles in our index yet.