CVE-2022-34911

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-34911

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-34911.json

Aliases

• BIT-mediawiki-2022-34911

Related

• DLA-3117-1
• DSA-5246-1

Published

2022-07-02T20:15:08Z

Modified

2023-12-06T01:02:24.267327Z

Details

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().

References

• https://phabricator.wikimedia.org/T308471
• https://security.gentoo.org/glsa/202305-24
• https://www.debian.org/security/2022/dsa-5246
• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/