CVE-2021-36130: XSS
First published: Fri Jul 02 2021(Updated: )
An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MediaWiki MediaWiki | <=1.36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this XSS issue?
The vulnerability ID for this XSS issue is CVE-2021-36130.
What is the affected software for this vulnerability?
The affected software for this vulnerability is MediaWiki through version 1.36.
What is the severity rating of CVE-2021-36130?
The severity rating of CVE-2021-36130 is medium (4.8).
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-79.
How can I fix the XSS issue in MediaWiki?
To fix the XSS issue in MediaWiki, update to a version beyond 1.36.
- agent/references
- agent/first-publish-date
- agent/last-modified-date
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/author
- agent/softwarecombine
- agent/description
- agent/type
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/mediawiki
- canonical/mediawiki mediawiki
- version/mediawiki mediawiki/1.36