PT-2022-22430 · Mediawiki+1 · Mediawiki+1

Marlon Starkloff · Published 2022-07-02 · Updated 2024-08-20 · CVE-2022-34911

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.7 MediaWiki versions 1.36.x MediaWiki versions 1.37.x prior to 1.37.3 MediaWiki versions 1.38.x prior to 1.38.1

Description An issue can occur in configurations that allow a JavaScript payload in a username, leading to XSS. After account creation, the username is not escaped when setting the page title to "Welcome" followed by the username. This happens because SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as the second parameter, and OutputPage::setPageTitle() uses text().

Recommendations For MediaWiki versions prior to 1.35.7, update to version 1.35.7 or later. For MediaWiki versions 1.36.x, update to version 1.37.3 or later. For MediaWiki versions 1.37.x prior to 1.37.3, update to version 1.37.3 or later. For MediaWiki versions 1.38.x prior to 1.38.1, update to version 1.38.1 or later. As a temporary workaround, consider restricting the use of JavaScript payloads in usernames to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2022-3361

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2022-34911

CVE-2022-34911

DLA-3117-1

DSA-5246-1

Affected Products

Alt Linux

Mediawiki

References · 20

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP · Vendor Advisory
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-34911 · Vendor Advisory
• https://phabricator.wikimedia.org/T308471 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3117-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2022-34911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34911 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-34911 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34911 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-34911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-34911 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-34911 · Security Note