PT-2022-5002 · Mediawiki+1 · Mediawiki+1

Aidilarf28 · Published 2021-12-19 · Updated 2024-03-06 · CVE-2021-44855

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.35.5 and earlier, 1.36.x before 1.36.3, 1.37.x before 1.37.1

Description The issue is related to Blind Stored XSS via a URL to the Upload Image feature. This could allow a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability exists due to inadequate protection of the web page structure in the VisualEditor component of MediaWiki.

Recommendations For MediaWiki versions 1.35.5 and earlier, update to version 1.35.5 or later. For MediaWiki versions 1.36.x before 1.36.3, update to version 1.36.3 or later. For MediaWiki versions 1.37.x before 1.37.1, update to version 1.37.1 or later. As a temporary workaround, consider restricting access to the Upload Image feature until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2021-3561

ALT-PU-2022-1199

BDU:2022-06215

BIT-MEDIAWIKI-2021-44855

CVE-2021-44855

DSA-5246-1

MGASA-2021-0568

Affected Products

Alt Linux

Mediawiki

References · 22

• 🔥 https://phabricator.wikimedia.org/T293589 · Exploit
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2021-44855 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0568 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-44855 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44855 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-44855 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44855 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44855 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06215 · Security Note
• https://advisories.mageia.org/MGASA-2021-0568.html · Security Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6 · Note