CVE-2022-42985 - The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS)

Back Back to CVE browser

MEDIUM

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS)

Published Nov 17, 2022

4.8

MEDIUM

CVSS 3.1

EPSS 0.39%

Description

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46034
Advisory
https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
PatchThird Party Advisory
https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22
PatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-46034		Advisory
https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104		PatchThird Party Advisory
https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22		PatchThird Party Advisory