mediawiki
Page content
- Author: kikadf
- Vulnerable: 1.18.1-1
- Unaffected: 1.19.16-1arcturus1
Omer Iqbal discovered that Mediawiki, a wiki engine, parses invalid usernames on Special:PasswordReset as wikitext when $wgRawHtml is enabled. On such wikis this allows an unauthenticated attacker to insert malicious JavaScript, a cross site scripting attack.