vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-21275

CSRF in MediaWiki Report extension

MEDIUM
4.3
CVSS Score
Published: January 25, 2021 at 10:45 PM UTC
Updated: June 17, 2026 at 03:35 AM UTC
4 products affected across 3 vendorsCommunications Pricing Design CenterCommunications Cloud Native Core Network Slice Selection FunctionReport

Using Report by Kenny2github?

Get instant alerts when new vulnerabilities affect Report - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.3
Exploit prediction
EPSS 0.7%

Description

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Communications Cloud Native Core Network Slice Selection Function· Oracle
95%
1.2.1
Communications Pricing Design Center· Oraclenpm
95%
12.0.0.4.012.0.0.5.0
Report· Report Projectmediawiki
95%
v < 2021-01-21
Affected range stops below 2021-01-21, so it looks safe — our inference, not a vendor statement
Report· KENNY2GITHUB
60%
v < f828dc6
Affected range stops below f828dc6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (4)

x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/Kenny2github/Report/commit/f828dc6f73cdfaea5639edbf8ac7b326eeefb117
x_refsource_CONFIRMPatchThird Party Advisory
Source: [email protected]
https://github.com/Kenny2github/Report/security/advisories/GHSA-9f3w-c334-jm2h
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.oracle.com//security-alerts/cpujul2021.html
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://www.oracle.com/security-alerts/cpuapr2022.html

CVSS

4.3MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card