Back to Database
Status published
Medium
CVE-2021-32774
Cross-Site Request Forgery (CSRF) in DataDump
Vulnerability Description
DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32774
Credits & Attribution
No credits recorded in the NVD database.
References
More from miraheze
View All →CVE-2025-53371
DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs
Critical
9.1
CVE-2025-43861
ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
Medium
4.4
CVE-2025-32964
ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions
Medium
4.6
CVE-2025-32956
ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
High
8
CVE-2024-47816
Users can impersonate import requesters if their actor IDs coincide in ImportDump
Medium
6.4
Affected Vendor
miraheze
View all reports →Affected Software
DataDump
Vulnerable Versions:
< 67a82b76e186925330b89ace9c5fd893a300830b
Timeline
Official Publish:
July 20th, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N