Description
An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.
Remediation
References
Related Vulnerabilities
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-14885)
Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3514)
WordPress Plugin Tigris for Salesforce PHP Object Injection (1.1.3)
WordPress Plugin WooCommerce Email Test Information Disclosure (1.5)
WordPress Plugin Google AdSense by BestWebSoft Cross-Site Scripting (1.29)