CVE-2022-29969: XSS
Published May 2, 2022
·Updated
The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).
Affected Software
1 affected component
MediaWiki Rss For Mediawiki<2022-04-29
Remediation
Patch Available
Event History
May 2, 2022
CVE Published
via MITRE·04:18 AM
Data Sourced
via MITRE·04:18 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-29969?
CVE-2022-29969 is considered a medium severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2022-29969?
To remediate CVE-2022-29969, update your MediaWiki to a version later than 2022-04-29.
3
Who is affected by CVE-2022-29969?
CVE-2022-29969 affects MediaWiki installations that utilize the RSS extension with the specific configurations mentioned.
4
What are the exploitation conditions for CVE-2022-29969?
CVE-2022-29969 can be exploited if the rss element is included in whitelisted feeds while $wgRSSAllowLinkTag is set to true.
5
What type of vulnerability is CVE-2022-29969?
CVE-2022-29969 is classified as a cross-site scripting (XSS) vulnerability.