Lucene search
MitreCVE-2022-42985HistoryNov 17, 2022 - 5:15 a.m.
CVE-2022-42985
2022-11-1705:15:15
CWE-79
mitre
web.nvd.nist.gov
38
10
cve-2022-42985
scratchlogin
mediawiki
xss
administrator privileges
nvd
CVSS3
4.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
19.4%
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
Affected configurations
Node
scratch-wikiscratch_loginRange≤1.1mediawiki
| Vendor | Product | Version | CPE |
|---|---|---|---|
| scratch-wiki | scratch_login | * | cpe:2.3:a:scratch-wiki:scratch_login:*:*:*:*:*:mediawiki:*:* |
References
Social References
More
Related
prion
prion
Cross site scripting
2022-11-17 05:15:00
cnvd
cnvd
MediaWiki Cross-Site Scripting Vulnerability (CNVD-2022-80687)
2022-11-21 00:00:00
cvelist
cvelist
CVE-2022-42985
2022-11-17 00:00:00
nvd
nvd
CVE-2022-42985
2022-11-17 05:15:15
CVSS3
4.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
19.4%
Related for CVE-2022-42985