Description

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

Remediation

References

CVE-2022-28202

Related Vulnerabilities

WordPress Plugin Easy Digital Downloads-Simple eCommerce for Selling Digital Files Cross-Site Scripting (2.10.3)

WordPress Plugin Print-O-Matic Cross-Site Scripting (2.1.7)

WordPress Plugin Pinterest Automatic Pin Security Bypass (4.14.3)

Ruby Improper Input Validation Vulnerability (CVE-2011-4815)

WordPress Plugin CP Reservation Calendar SQL Injection (1.1.6)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2022-28202