CVE-2021-29483 wikiconfig API leaked private config variables set through ManageWiki
The wikiconfig API exposed private configuration variables to all users, allowing unauthorized data access in MediaWiki installations using ManageWiki.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29483?
CVE-2021-29483 is a critical vulnerability in miraheze ManageWiki, published on 28 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.
Weakness: CWE-200
Which versions are affected by CVE-2021-29483?
It affects 1 product.
Products include Miraheze Managewiki.
How do I fix CVE-2021-29483?
No fix has been published for CVE-2021-29483 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-29483 being exploited?
There is no known exploitation of CVE-2021-29483 in the wild and no public exploit code.
Other vulnerabilities in miraheze ManageWiki
- CVE-2025-32956 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
- CVE-2024-25109 Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki
- CVE-2025-32964 Missing authorization in ManageWiki
- CVE-2025-43861 ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
Sources
Also known as GHSA-jmc9-rv2f-g8vv.