LiveActive security incident?Get immediate response
CVE Record

CVE-2021-31556: An issue was discovered in the Oauth extension for MediaWiki through 1.35.2.

An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This issue affects the MediaWiki OAuth extension through 1.35.2. The software did not verify that a submitted RSA key was small enough for the MySQL blob field. The provided sources do not give CVSS, confirmed impact, or evidence of exploitation, so urgency depends on whether exposed OAuth consumer registration exists in your MediaWiki environment.

Executive priority

Treat this as a targeted maintenance item unless your MediaWiki OAuth registration surface is exposed to untrusted users. The sources do not justify emergency response, but affected systems should be updated through normal vulnerability management because the defect is publicly documented.

Technical view

MWOAuthConsumerSubmitControl.php lacked a size check ensuring an RSA key fits the backing MySQL blob column. The concrete failure mode is not fully described in the provided bundle. Evidence supports an input-validation defect in MediaWiki's OAuth extension, with upstream Gerrit and Fedora advisory references, but not a confirmed exploitation path.

Likely exposure

Organizations running MediaWiki with the OAuth extension through 1.35.2 may be exposed. Risk is most relevant where OAuth consumer submission is available to users or administrators. The bundle does not identify affected distributions beyond Fedora advisory references.

Exploitation context

The CVE is not listed as KEV, and the provided sources do not state active exploitation or public weaponization. The issue appears tied to oversized RSA key submission causing improper database handling, but exact attacker prerequisites and business impact are not established in the bundle.

Researcher notes

Available evidence is thin: no CVSS, CWE, detailed impact, or exploitation confirmation is included. Focus analysis on the OAuth consumer submission path, RSA key length validation, MySQL blob storage behavior, and the upstream Gerrit change linked from the CVE references.

Mitigation direction

  • Identify MediaWiki systems using the OAuth extension through 1.35.2.
  • Apply vendor or distribution updates referenced by Wikimedia or Fedora guidance.
  • Review Wikimedia Gerrit change details before backporting any local fix.
  • Restrict OAuth consumer submission to trusted users where operationally possible.
  • Monitor vendor advisories for clearer severity and fixed-version guidance.

Validation and detection

  • Inventory MediaWiki versions and enabled extensions across public and internal wikis.
  • Confirm whether the OAuth extension is installed and active.
  • Check whether OAuth consumer registration accepts RSA keys in your deployment.
  • Review application and database logs for OAuth consumer submission errors.
  • Verify patched packages or upstream fixes are present after remediation.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-31556 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.