CVE-2022-34912

6.1

MEDIUMCVSS v3

Published

July 2, 2022

CVSS v2

4.3 MEDIUM

Affected

10 projects

Assigned by

MITRE

Severity scale

010

Description

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.

wikimedia/mediawiki

GitHub🌻 The collaborative editing software that runs Wikipedia. Mirror from https://gerrit.wikimedia.org/g/mediawiki/core. See https://mediawiki.org/wiki/Developer_access for contributing.

= 1.38.0, < 1.37.3NVD