CVE-2022-34911 Cross-site scripting in n/a
Cross-site scripting vulnerability in MediaWiki allows attackers to execute scripts via unescaped usernames in specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-34911?
CVE-2022-34911 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 2 Jul 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().
Weakness: CWE-79
Which versions are affected by CVE-2022-34911?
1 open source package ship an affected version, including mediawiki. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | All versions | 1.35.7, 1.37.3, 1.38.1 |
Products include Fedoraproject Fedora, Mediawiki Mediawiki.
How do I fix CVE-2022-34911?
Upgrade mediawiki to a fixed version for your release line: 1.35.7, 1.37.3 or 1.38.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-34911 being exploited?
There is no known exploitation of CVE-2022-34911 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-mediawiki-2022-34911, DEBIAN-CVE-2022-34911, GHSA-jjr9-g78r-wg8r, UBUNTU-CVE-2022-34911.