InternationalScratchWiki/mediawiki-scratch-login

InternationalScratchWiki/mediawiki-scratch-login

Releases0

Stars5

MediaWiki extension to allow logging in with one's Scratch account

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-42985 ↗	Nov 17, 2022Thursday, 17 November 2022, 05:15	4.8 MEDIUM	—
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
CVE-2020-15164 ↗	Aug 28, 2020Friday, 28 August 2020, 17:15	10 CRITICAL	6.4 MEDIUM
in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.