CVE-2021-45472
published 2021-12-24CVE-2021-45472: In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.97%
58.6th percentile
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| mediawiki | mediawiki | <= 1.37 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6j65-7rx3-56x5: In MediaWiki through 1
ghsa_unreviewed·2021-12-25
CVE-2021-45472 [MEDIUM] CWE-79 GHSA-6j65-7rx3-56x5: In MediaWiki through 1
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
OSV
CVE-2021-45472: In MediaWiki through 1
osv·2021-12-24·CVSS 6.1
CVE-2021-45472 [MEDIUM] CVE-2021-45472: In MediaWiki through 1
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Red Hat
mediawiki: XSS in Wikibase using formatter URL
vendor_redhat·2021-12-17·CVSS 6.1
CVE-2021-45472 [MEDIUM] CWE-79 mediawiki: XSS in Wikibase using formatter URL
mediawiki: XSS in Wikibase using formatter URL
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
A flaw was found in mediawiki in versions through 1.37. A cross-site scripting attack (XSS) can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Statement: The mediawiki package was removed from OpenShift Container Platform (OCP) in version 4.3, therefore for OCP 4 has been marked as out of support scope.
Package: mediawiki (Red Hat OpenShift Container Platform 4) - Out of support s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gerrit.wikimedia.org/r/q/I37ece1dfdc80d38055067c9c4fa73ba591acd8bdhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/https://phabricator.wikimedia.org/T297570https://gerrit.wikimedia.org/r/q/I37ece1dfdc80d38055067c9c4fa73ba591acd8bdhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/https://phabricator.wikimedia.org/T297570
2021-12-24
Published