Описание
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
In mediawiki package all the mediastatistics-header-* messages are outputted in HTML unescaped, which could leading to Cross-site Scripting (XSS).
Отчет
The mediawiki package was removed from OpenShift Container Platform (OCP) in version 4.3, therefore for OCP 4 has been marked as out of support scope.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | mediawiki | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | mediawiki | Out of support scope |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through ...
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
Уязвимость программного средства для реализации гипертекстовой среды MediaWiki, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации
6.1 Medium
CVSS3