ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the actioninfo parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img srcx onerroralert()>}}`. This issue has a patch in version 2.3.4.
Publication date: Tue, 25 Jan 2022 02:15:00 +0000