CVE-2021-39186 Improper Input Validation in GlobalNewFiles
Stored XSS in GlobalNewFiles allows attackers to execute scripts via usernames, affecting MediaWiki users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-39186?
CVE-2021-39186 is a medium-severity cross-site scripting vulnerability in miraheze GlobalNewFiles, published on 1 Sep 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.
Weakness: CWE-20
Which versions are affected by CVE-2021-39186?
It affects 1 product.
Products include Miraheze Globalnewfiles.
How do I fix CVE-2021-39186?
No fix has been published for CVE-2021-39186 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-39186 being exploited?
There is no known exploitation of CVE-2021-39186 in the wild and no public exploit code.
Other vulnerabilities in miraheze GlobalNewFiles
Sources
Also known as GHSA-57p5-hqjq-h7vg.