CVE-2021-45472 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

6.1MEDIUMNVD

EPSS

0.3%

top 50.99%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mediawiki Fedoraproject Fedora

Timeline

PublishedDec 24

Latest updateDec 25

Description

In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDmediawiki/mediawiki1.37

Also affects: Fedora 35

🔴Vulnerability Details

GHSA

GHSA-6j65-7rx3-56x5: In MediaWiki through 1↗2021-12-25

▶

OSV

CVE-2021-45472: In MediaWiki through 1↗2021-12-24

▶

📋Vendor Advisories

Red Hat

mediawiki: XSS in Wikibase using formatter URL↗2021-12-17

▶