Medium severity4.8NVD Advisory· Published Jan 10, 2022· Updated Jun 17, 2026

CVE-2021-46150

Description

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MediaWiki/MediaWikidescription
MediaWiki/Mediawiki2 versions
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: <1.35.5
- (no CPE)range: <1.35.5, <1.36.3, <1.37.1
osv-coords
pkg:bitnami/mediawiki
Range: < 1.35.5
Wikimedia Foundation/CheckUserllm-create
Range: <1.35.5, <1.36.3, <1.37.1

Patches

Vulnerability mechanics

References

phabricator.wikimedia.org/T292795nvdExploitThird Party Advisory
gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CheckUser/+/79c2c49a18f96b159258958feca90fce964c350anvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000