Description
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.
Remediation
References
Related Vulnerabilities
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-0218)
WordPress Plugin Analytics Remote Code Execution (1.7)
MySQL CVE-2022-21332 Vulnerability (CVE-2022-21332)
CubeCart Improper Input Validation Vulnerability (CVE-2012-0865)
Dot CMS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-11466)