Description

In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.

Remediation

References

CVE-2021-45472

Related Vulnerabilities

CubeCart Session Fixation Vulnerability (CVE-2021-33394)

Oracle JRE CVE-2013-5790 Vulnerability (CVE-2013-5790)

Internet Information Services CVE-2002-1790 Vulnerability (CVE-2002-1790)

Internet Information Services Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-3972)

WordPress Plugin Html5 Audio Player-Audio Player for WordPress Cross-Site Scripting (2.1.2)

Severity

Medium

Classification

CVE-2021-45472 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities