PT-2021-21127 · Mediawiki+1 · Socialprofile Extension+2

Ashley · Published 2021-06-12 · Updated 2024-03-06 · CVE-2021-36130

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36 SocialProfile extension in MediaWiki versions through 1.36

Description: An XSS issue was discovered in the SocialProfile extension within MediaWiki. A privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields in several special pages. This could easily propagate across many pages for many users.

Recommendations: For MediaWiki versions through 1.36, update to a version that includes a fix for this issue. For the SocialProfile extension in MediaWiki versions through 1.36, consider disabling the extension until a patch is available. Restrict access to gift-related special pages to minimize the risk of exploitation. Avoid using the awardmanage right for users who do not need it, to reduce the potential for arbitrary HTML and JavaScript injection.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-1991

ALT-PU-2021-2091

BIT-MEDIAWIKI-2021-36130

CVE-2021-36130

Affected Products

Alt Linux

Mediawiki

Socialprofile Extension

References · 8

• 🔥 https://phabricator.wikimedia.org/T281043 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-36130 · Security Note
• https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-36130 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36130 · Vendor Advisory
• https://t.me/cvenotify/16991 · Telegram Post
• https://t.me/cvenotify/16982 · Telegram Post
• https://t.me/cibsecurity/25891 · Telegram Post