CVE-2021-39186: Improper Input Validation in GlobalNewFiles
GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GlobalNewFiles (MediaWiki extension)to a version that resolves this vulnerability.Patch cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d - Configuration
As a workaround to prevent stored XSS, configure the system so that account names cannot contain '<' or '>' (or other characters required to insert html/js), preventing the vulnerable username column from being populated with executable markup.
GlobalNewFiles (MediaWiki extension) Account name character validation = Disallow '<' and '>' (and other characters required to insert html/js) from being used in account names
Event History
Frequently Asked Questions
What is the severity of CVE-2021-39186?
CVE-2021-39186 is classified as a medium severity vulnerability due to its potential for stored XSS exploitation.
How do I fix CVE-2021-39186?
To fix CVE-2021-39186, update the GlobalNewFiles extension to a version later than 2021-09-01.
What does CVE-2021-39186 affect?
CVE-2021-39186 affects the GlobalNewFiles extension for MediaWiki prior to the specified commit.
What is stored XSS in relation to CVE-2021-39186?
Stored XSS in CVE-2021-39186 refers to an attacker being able to inject malicious scripts that are stored in the database and executed on others' browsers.
Who maintains the GlobalNewFiles extension related to CVE-2021-39186?
GlobalNewFiles is maintained by Miraheze.