Description

An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log.

Remediation

References

CVE-2021-42041

Related Vulnerabilities

TCExam Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-20116)

WordPress Plugin XCloner-Backup and Restore Multiple Vulnerabilities (3.1.2)

PHP Other Vulnerability (CVE-2015-0231)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33333)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-3725)

Severity

Medium

Classification

CVE-2021-42041 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities