CVE-2022-34912: Medium severity MediaWiki MediaWiki vulnerability
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/mediawikito a version that resolves this vulnerability.Fixed in 1:1.39.17-1+deb12u2Fixed in 1:1.43.9+dfsg-1~deb13u1Fixed in 1:1.43.11+dfsg-3 - Upgrade
Upgrade
debian/mediawikito a version that resolves this vulnerability.Fixed in 1:1.35.7-1 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.37.3 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.38.1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34912?
CVE-2022-34912 has been classified with a high severity due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2022-34912?
To remediate CVE-2022-34912, upgrade to MediaWiki version 1.37.3, 1.38.1, or later.
What software is affected by CVE-2022-34912?
CVE-2022-34912 affects MediaWiki versions prior to 1.37.3 and 1.38.x before 1.38.1.
Can CVE-2022-34912 allow for remote code execution?
CVE-2022-34912 does not directly allow for remote code execution, but it can lead to cross-site scripting vulnerabilities.
Is there a workaround for CVE-2022-34912?
Currently, the recommended approach for CVE-2022-34912 is to update to the patched versions rather than implementing a workaround.