Description
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress Download Manager Remote Code Execution (2.7.4)
WebLogic CVE-2016-3551 Vulnerability (CVE-2016-3551)
Oracle Database Server CVE-2010-0903 Vulnerability (CVE-2010-0903)
WordPress Plugin Improved user search in backend Cross-Site Request Forgery (1.2.4)
ATutor Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3706)