CVE-2021-42044

Description

An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.

How to fix CVE-2021-42044

To remediate CVE-2021-42044, upgrade the affected package to a fixed version below.

• —upgrade to 1.36.3 or later

Is CVE-2021-42044 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.36.3

CVSS scores

References (3)

• WEBgerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6
• WEBnvd.nist.gov/vuln/detail/CVE-2021-42044
• WEBphabricator.wikimedia.org/T289408