Description
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
Remediation
References
Related Vulnerabilities
OpenSSL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2021-23839)
Caddy Web Server Improper Authentication Vulnerability (CVE-2018-21246)
WordPress Plugin YITH WooCommerce PDF Invoice and Shipping List Security Bypass (1.2.12)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-3050)