CVE-2021-32774 json
Cross-Site Request Forgery (CSRF) in DataDump
published 2021-07-20 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19538
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.
Patch / fix
- miraheze datadump 2021-07-07
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P |
Affected products
- miraheze DataDump
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/miraheze/DataDump/commit/67a82b76e186925330b89ace9c5fd893a300830b
patch, third-party-advisory
-
github.com
/miraheze/DataDump/security/advisories/GHSA-29mh-4vhv-x8mr
patch, third-party-advisory
-
phabricator.miraheze.org
/T7593
third-party-advisory
Sources
- CVE List CVE-2021-32774
- NVD CVE-2021-32774
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.