CVE-2021-45471: 
NixOS vulnerability analysis and mitigation

In MediaWiki through version 1.37, a security vulnerability was identified where blocked IP addresses were allowed to edit EntitySchema items. This vulnerability was assigned CVE-2021-45471 and was discovered in December 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The CVSS v2.0 Base Score is 5.0 (MEDIUM) with the vector (AV:N/AC:L/Au:N/C:N/I:P/A:N). This indicates that the vulnerability is network accessible, requires low attack complexity, and can result in partial impact to integrity (NVD).

The vulnerability allows unauthorized modification of EntitySchema items by blocked IP addresses, potentially compromising the integrity of wiki content. This could lead to unauthorized changes to the schema structure despite IP blocking measures being in place (NVD).

The vulnerability was addressed in subsequent releases after MediaWiki 1.37. Fedora released an update (mediawiki-1.36.3-1.fc35) to address this vulnerability. Users are advised to upgrade to the latest version of MediaWiki (Fedora Update).