Vulnerability · Published Oct 6, 2021 · Assigned by mitre
CVE-2021-42042
Medium 4.8
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-invalid-title MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.
Affected products (as reported)
References
- https://phabricator.wikimedia.org/T290692 x_refsource_MISC
- https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f x_refsource_MISC