Description
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value.
Remediation
References
Related Vulnerabilities
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2019-17571)
WordPress Plugin BP Group Documents Security Bypass (1.10)
MySQL CVE-2020-2762 Vulnerability (CVE-2020-2762)
concrete5 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-11476)
WordPress Plugin Logo Slider and Showcase Security Bypass (1.3.36)