CVE-2021-45472: XSS
Published Dec 24, 2021
·Updated
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
Affected Software
2 affected components
MediaWiki<=1.37
fedoraproject fedora=35
Event History
Dec 24, 2021
CVE Published
via MITRE·01:04 AM
Data Sourced
via MITRE·01:04 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-45472?
CVE-2021-45472 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2021-45472?
To fix CVE-2021-45472, upgrade to MediaWiki version 1.38 or later.
3
What type of vulnerability is CVE-2021-45472?
CVE-2021-45472 is a Cross-Site Scripting (XSS) vulnerability affecting MediaWiki.
4
Which versions of MediaWiki are affected by CVE-2021-45472?
CVE-2021-45472 affects MediaWiki versions up to and including 1.37.
5
Is Fedora 35 affected by CVE-2021-45472?
Yes, Fedora 35 is affected by CVE-2021-45472 when using MediaWiki.