medium4.8
CVE-2022-42985
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform…
Impact
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Scratch-Wiki | Scratch Login | through 1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
- https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22
- https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
- https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22