Description
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.
Remediation
References
Related Vulnerabilities
WordPress Plugin iThemes Security (formerly Better WP Security) Cross-Site Scripting (5.3.4)
OpenSSL Integer Overflow or Wraparound Vulnerability (CVE-2021-23840)
PHP Out-of-bounds Write Vulnerability (CVE-2022-31627)
Moodle CVE-2011-4291 Vulnerability (CVE-2011-4291)
MediaWiki Improper Restriction of XML External Entity Reference Vulnerability (CVE-2014-9487)