LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36126: An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36.

An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but that English version could also be invalid on a wiki. This would result in a fatal error, and potentially fail to block or restrict a potentially nefarious user.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE affects MediaWiki sites using the AbuseFilter extension through 1.36. A malformed AbuseFilter blocker system message could trigger a fatal error when enforcement is needed, potentially preventing a block or restriction from being applied to a problematic user.

Executive priority

Treat as moderate operational priority for MediaWiki environments where AbuseFilter is relied on for abuse control. It can weaken enforcement, but sources do not support emergency exploitation claims.

Technical view

AbuseFilter may fall back from an invalid localized MediaWiki:Abusefilter-blocker message to the English version. If the English fallback is also invalid on that wiki, the enforcement path can fatal-error and may fail to block or restrict the target user.

Likely exposure

Exposure is most relevant to self-hosted or managed MediaWiki deployments using AbuseFilter through version 1.36, especially wikis with customized or invalid MediaWiki:Abusefilter-blocker messages.

Exploitation context

The provided sources do not show active exploitation, KEV listing, public exploit code, or CVSS scoring. The risk is operational enforcement bypass caused by configuration/content-message failure, not a documented remote code execution path.

Researcher notes

Evidence is limited to the CVE description and Wikimedia references. No CVSS, CWE, affected CPEs, exploit status, or exact fixed release is included in the supplied bundle. Validate fixes against Wikimedia task and Gerrit records before asserting closure.

Mitigation direction

  • Check Wikimedia guidance and Gerrit change details for the fixed AbuseFilter version.
  • Update MediaWiki and AbuseFilter according to vendor-supported maintenance guidance.
  • Review MediaWiki:Abusefilter-blocker messages for invalid content in all relevant languages.
  • Correct invalid local and English fallback blocker messages where present.

Validation and detection

  • Inventory MediaWiki instances using AbuseFilter through version 1.36.
  • Confirm whether MediaWiki:Abusefilter-blocker has local customizations or invalid message content.
  • Test AbuseFilter block and restriction behavior in a non-production environment.
  • Review application logs for AbuseFilter fatal errors during enforcement decisions.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36126 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.