MediaWiki WikibaseMediaInfo Cross-Site Scripting Vulnerability (CNVD-2022-03945)

MediaWiki is a free and free-to-use web-based wiki engine from the U.S. Wikimedia (MediaWiki) Foundation. The product can be used to deploy internal knowledge management and content management systems.A cross-site scripting vulnerability exists in MediaWiki, which stems from a failure of the product’s WikibaseMediaInfo component to properly handle the title field of a given media file. An attacker could exploit the vulnerability to execute JavaScript code on the client side.