Description
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.
Remediation
References
Related Vulnerabilities
Sqlite NULL Pointer Dereference Vulnerability (CVE-2020-9327)
WordPress Plugin Brute Force Login Protection Cross-Site Scripting (1.5.2)
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3946)
Jboss EAP Improper Input Validation Vulnerability (CVE-2010-3862)
IBM WebSEAL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1805)