Description

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a mentor account and trigger an XSS payload (such as alert) via Growthexperiments-mentor-dashboard-mentee-overview-no-js-fallback.

Remediation

References

CVE-2021-42047

Related Vulnerabilities

XWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-32731)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-14721)

Atlassian Confluence CVE-2023-22508 Vulnerability (CVE-2023-22508)

Oracle JRE CVE-2022-21628 Vulnerability (CVE-2022-21628)

WordPress Plugin Check & Log Email Cross-Site Scripting (1.0.3)

Severity

Medium

Classification

CVE-2021-42047 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities