What’s Vulnerable › Vulnerabilities

CVE-2022-42985

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-17 · updated 2026-06-17
• Weakness: CWE-79

Description

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).

Affected products

• InternationalScratchWiki mediawiki-scratch-login: through 1.1

References

• https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
• https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22
• https://github.com/InternationalScratchWiki/mediawiki-scratch-login/blob/4d2c1229b558b9cd685961274f20b621d114f4db/ScratchLogin.common.php#L104
• https://github.com/InternationalScratchWiki/mediawiki-scratch-login/pull/22

Get alerted when CVE-2022-42985 or the next vulnerability affects your stack