Non évaluée
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that al...
CVE-2022-34911
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-34911 mediawiki Corrigé dans: 1:1.35.8-1~deb11u1
- Ubuntu UBUNTU-CVE-2022-34911 mediawiki
Description d'origine La description telle que publiée par la source (souvent en anglais).
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().
Références
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- web phabricator.wikimedia.org
- web lists.debian.org