CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42041
https://notcve.org/view.php?id=CVE-2021-42041
An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log. Se ha detectado un problema en CentralAuth en MediaWiki versiones hasta 1.36.2. El mensaje rightsnone de MediaWiki no estaba siendo saneado correctamente y permitía una inyección y ejecución de HTML y JavaScript por medio del registro setchange • https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35 https://phabricator.wikimedia.org/T291696 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42042
https://notcve.org/view.php?id=CVE-2021-42042
An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript. Se ha detectado un problema en SpecialEditGrowthConfig en la extensión GrowthExperiments en MediaWiki versiones hasta 1.36.2. El mensaje growthexperiments-edit-config-error-invalid-title de MediaWiki no estaba siendo saneado apropiadamente y permitía una inyección y ejecución de HTML y JavaScript • https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f https://phabricator.wikimedia.org/T290692 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42043
https://notcve.org/view.php?id=CVE-2021-42043
An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-you-mean) was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator within the query. Se ha detectado un problema en la función Special:MediaSearch en la extensión MediaSearch en MediaWiki versiones hasta 1.36.2. El texto de la sugerencia (un parámetro de mediasearch-did-you-mean) no saneaba apropiadamente y permitía una inyección y ejecución de HTML y JavaScript por medio del operador de búsqueda intitle: dentro de la consulta • https://gerrit.wikimedia.org/r/q/If64eb5842237c92290d07ebc3fe14710d9de3fc2 https://phabricator.wikimedia.org/T291600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-42044
https://notcve.org/view.php?id=CVE-2021-42044
An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript. Se ha detectado un problema en el panel de control de Mentor en la extensión GrowthExperiments en MediaWiki versiones hasta 1.36.2. Los encabezados Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, y growthexperiments-mentor-dashboard-mentee-overview-active-ago Los mensajes de MediaWiki no estaban siendo saneados correctamente y permitían una inyección y ejecución de HTML y JavaScript • https://gerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6 https://phabricator.wikimedia.org/T289408 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 1CVE-2021-35197
https://notcve.org/view.php?id=CVE-2021-35197
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented). En MediaWiki versiones anteriores a 1.31.15, versiones 1.32.x hasta 1.35.x, versiones anteriores a 1.35.3, y versiones 1.36.x anteriores a 1.36.1, unos bots presentan determinados accesos a la API no deseados. Cuando una cuenta de bot presenta un "sitewide block" aplicado, es capaz de "purge" páginas mediante la API de acción de MediaWiki (lo que un "bloqueo del sitio" debería haber impedido) • https://lists.debian.org/debian-lts-announce/2021/10/msg00003.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6AP • CWE-863: Incorrect Authorization •