| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | ≥ 1.40.0, < 1.40.2≥ 1.41.0, < 1.41.1< 1.39.6 | 1.40.21.41.11.39.6 |
An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free