Read the docs
TI-2021-12441 Aliases CVE-2021-32774

Cross-Site Request Forgery (CSRF) in DataDump

Priority LOW 28CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.

Why it matters now

EPSS 0.00476 41st percentileScored 2026-11-07
Fix Fixed DataDump (miraheze): 67a82b76e186925330b89ace9c5fd893a300830b

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirahezeDataDumpbefore 67a82b76e186925330b89ace9c5fd893a300830b67a82b76e186925330b89ace9c5fd893a300830bPatch availableCNA
  • DataDump Vendormiraheze Affected before 67a82b76e186925330b89ace9c5fd893a300830b Fixed in 67a82b76e186925330b89ace9c5fd893a300830b Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:miraheze:datadump:*:*:*:*:*:*:*:*before 2021-07-07Vulnerablemiraheze
  • cpe:2.3:a:miraheze:datadump:*:*:*:*:*:*:*:* Versions before 2021-07-07 Vulnerable ·miraheze

Remediation

  • Fix · CNA DataDump (miraheze) Fixed in 67a82b76e186925330b89ace9c5fd893a300830b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32774

References

Patch 2

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences