Read the docs
TI-2021-10196 Aliases CVE-2021-29483

wikiconfig API leaked private config variables set through ManageWiki

Priority MEDIUM 43CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Why it matters now

EPSS 0.01211 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirahezeManageWiki< befb83c66f5b643e174897ea41a8a46679b26304—No fix listedCNA
  • ManageWiki Vendormiraheze Affected < befb83c66f5b643e174897ea41a8a46679b26304 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:*before 2021-04-28Vulnerablemiraheze
  • cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:* Versions before 2021-04-28 Vulnerable ·miraheze

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29483

References

Patch 2

Advisory 1

  • TI-2025-23966 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob CVSS 3.1HIGH 8.0
  • TI-2024-16564 Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki CVSS 3.1MEDIUM 6.5
  • TI-2025-28445 ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection CVSS 3.1MEDIUM 5.4
  • TI-2025-23974 Improper authorization in miraheze ManageWiki CVSS 3.1MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences