PT-2022-19906 · Mediawiki+1 · Mediawiki Nimbus Skin+1

Ashley · Published 2022-04-29 · Updated 2024-08-20 · CVE-2022-29907

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki Nimbus skin versions through 1.37.2

Description The issue allows XSS in Advertise link messages.

Recommendations For MediaWiki Nimbus skin versions through 1.37.2, update to a version after 6f9c8fb868345701d9544a54d9752515aace39df to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-3361

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2022-29907

CVE-2022-29907

Affected Products

Alt Linux

Mediawiki Nimbus Skin

References · 7

• 🔥 https://phabricator.wikimedia.org/T306815 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29907 · Security Note
• https://gerrit.wikimedia.org/r/c/786959 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2022-29907 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29907 · Vendor Advisory
• https://t.me/cvenotify/29830 · Telegram Post
• https://t.me/cibsecurity/41614 · Telegram Post