未評価
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login wi...
CVE-2021-42047
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.
参照URL
- patch gerrit.wikimedia.org
- patch phabricator.wikimedia.org