CVE-2021-35197: 
NixOS vulnerability analysis and mitigation

CVE-2021-35197 affects MediaWiki versions before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1. The vulnerability allows bot accounts with a 'sitewide block' to still 'purge' pages through the MediaWiki Action API, which should have been prevented by the block (Wikimedia Announce, NVD).

The vulnerability stems from an incorrect authorization implementation where the PurgeAction class had an override that allowed blocked users to still perform page purges. The CVSS v3.1 base score is 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The fix involved removing the requiresUnblock override and implementing proper block checks in the API (Phabricator).

When exploited, this vulnerability allows blocked bot accounts to continue purging pages through the MediaWiki Action API, effectively bypassing site-wide blocks. This could lead to potential abuse of the purge functionality and undermining of administrative actions (NVD).

The vulnerability was fixed in MediaWiki versions 1.31.15, 1.35.3, and 1.36.1. Users are advised to upgrade to these or later versions. Various Linux distributions have also released security updates, including Debian (DSA-4979-1), Fedora, and Gentoo (Debian Security, Gentoo Security).