Vulnerabilities

TI-2022-20963 CVE-2022-42985 · GHSA-rmx9-w5vx-r35r

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure…

LOW 22

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00406 Published 2022-11-17 No fix listed CWE-79

TI-2021-21135 CVE-2021-46252 · GHSA-xjc2-47vq-w6wg

A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki…

LOW 29

A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00484 Published 2022-02-15 No fix listed CWE-352

TI-2020-11951 CVE-2020-15179

HTML Injection in ScratchSig

MEDIUM 41

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0122 Published 2020-09-15 Fixed in 1.0.1 CWE-79

TI-2020-11936 CVE-2020-15164

Authentication Bypass in Scratch Login (mediawiki-scratch-login)

MEDIUM 45

in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01174 Published 2020-08-28 Fixed in 1.1 CWE-287

Vulnerabilities

Filters

The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure…

A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki…

HTML Injection in ScratchSig

Authentication Bypass in Scratch Login (mediawiki-scratch-login)