CVE-2021-45473
published 2021-12-24CVE-2021-45473: In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.25%
66.4th percentile
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| mediawiki | mediawiki | <= 1.3.7 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mediawiki: XSS on page information Wikibase central description
vendor_redhat·2021-11-30·CVSS 6.1
CVE-2021-45473 [MEDIUM] CWE-79 mediawiki: XSS on page information Wikibase central description
mediawiki: XSS on page information Wikibase central description
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
A flaw was found in mediawiki through version 1.37. Wikibase item descriptions allow cross-site scripting attacks (XSS), which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
Statement: The mediawiki package was removed from OpenShift Container Platform (OCP) in version 4.3, therefore for OCP 4 has been marked as out of support scope.
Package: mediawiki (Red Hat OpenShift Container Platform 4) - Out of support scope
GHSA
GHSA-78f2-h8g8-qj93: In MediaWiki through 1
ghsa_unreviewed·2021-12-25
CVE-2021-45473 [MEDIUM] CWE-79 GHSA-78f2-h8g8-qj93: In MediaWiki through 1
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
OSV
CVE-2021-45473: In MediaWiki through 1
osv·2021-12-24·CVSS 6.1
CVE-2021-45473 [MEDIUM] CVE-2021-45473: In MediaWiki through 1
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gerrit.wikimedia.org/r/q/I3cd080a1a7dacd7396d37ee0c98cff0b4e241f8dhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/https://phabricator.wikimedia.org/T294693https://gerrit.wikimedia.org/r/q/I3cd080a1a7dacd7396d37ee0c98cff0b4e241f8dhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7JNQA53K675TQBBJPZRAG5ZT6XES3IS/https://phabricator.wikimedia.org/T294693
2021-12-24
Published