Description

An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log.

Remediation

References

CVE-2021-42041

Related Vulnerabilities

PHP Use After Free Vulnerability (CVE-2016-4473)

WordPress Plugin AccessPress Social Share includes Backdoor [Only if downloaded via the vendor website] (4.5.5)

Perl Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-2827)

Oracle JRE CVE-2022-21626 Vulnerability (CVE-2022-21626)

PHP Numeric Errors Vulnerability (CVE-2008-1384)

Severity

Medium

Classification

CVE-2021-42041 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities