PT-2021-19422 · Mediawiki+1 · Pageforms+2

Alex Winkler + 1 · Published 2021-04-22 · Updated 2024-03-06 · CVE-2021-31551

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35.2 PageForms extension for MediaWiki versions through 1.35.2

Description An issue was discovered in the PageForms extension for MediaWiki, allowing for XSS on certain PageForms-managed MediaWiki pages. This is achieved through crafted payloads for Token-related query parameters.

Recommendations For MediaWiki versions through 1.35.2, update to a version that contains a fix for this issue. For PageForms extension for MediaWiki versions through 1.35.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1991

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-31551

CVE-2021-31551

Affected Products

Alt Linux

Mediawiki

Pageforms

References · 7

• https://osv.dev/vulnerability/CVE-2021-31551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31551 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2021-31551 · Vendor Advisory
• https://gerrit.wikimedia.org/r/q/Ibe68b070ee791cd0c8e7f50eb04ac4e066b1512c · Note
• https://gerrit.wikimedia.org/r/q/I20b63bd38779d2ccbe2d86f9879df85ca3b685f6 · Note
• https://gerrit.wikimedia.org/r/q/I5e0abbc2f80e6bda255b3b32a4df39a7fe7d3793 · Note
• https://phabricator.wikimedia.org/T259433 · Note