CVE-2021-46146

MEDIUM

MediaWiki < 1.35.5, 1.36.x < 1.36.3, 1.37.x < 1.37.1 - Cross-Site Scripting in WikibaseMediaInfo Caption Fields

Title source: llm
STIX 2.1

Description

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://phabricator.wikimedia.org/T293556

Scores

CVSS v3 5.4
EPSS 0.0016
EPSS Percentile 36.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
mediawiki/mediawiki < 1.35.5
Published Jan 10, 2022
Tracked Since Feb 18, 2026