CVE-2021-45474: XSS
Published Dec 24, 2021
·Updated
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
Affected Software
2 affected components
MediaWiki<=1.37
fedoraproject fedora=35
Event History
Dec 24, 2021
CVE Published
via MITRE·01:03 AM
Data Sourced
via MITRE·01:03 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2021-45474?
CVE-2021-45474 is classified as a medium severity vulnerability due to its potential for exploitation through XSS.
2
How do I fix CVE-2021-45474?
To fix CVE-2021-45474, users should upgrade to MediaWiki version 1.38 or later, as this version addresses the vulnerability.
3
Which versions of MediaWiki are affected by CVE-2021-45474?
CVE-2021-45474 affects all MediaWiki versions up to and including 1.37.
4
What are the consequences of exploiting CVE-2021-45474?
Exploiting CVE-2021-45474 can lead to cross-site scripting (XSS), potentially allowing an attacker to execute scripts in the context of a user's session.
5
Is CVE-2021-45474 specific to certain operating systems?
CVE-2021-45474 is not limited to a specific operating system but affects MediaWiki installations on any system using versions up to 1.37.