Making public since was reported public and pushed through gerrit.
Please request a CVE & add to next supplement for the issues reported in https://www.mediawiki.org/wiki/Extension_talk:CreateRedirect & https://phabricator.miraheze.org/T9061 that were fixed with https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CreateRedirect/+/780567
This extension had insufficient permissions checks.
Hey @RhinosF1 -
I've got this tracked for the next supplemental security release here: T305209. We'll plan to request a CVE for it by the end of this quarter (June 2022) though if anybody else would like to handle that sooner, that's fine. Looks like the backports are all merged as well, so that's good. I'm going to resolve this for now since I don't believe there's anything else actionable at this time.
That's fine. I'm only used to GitHub's CVE process. If there's anyway we can help you, do let me know.
tbh, the Security-Team typically just uses https://cveform.mitre.org/. We had talked about becoming a CNA at one point, but never did.