CVE-2021-42045

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b85245460774c81c7639a578Patch, Vendor Advisory
https://phabricator.wikimedia.org/T289385Vendor Advisory
https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b85245460774c81c7639a578Patch, Vendor Advisory
https://phabricator.wikimedia.org/T289385Vendor Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420466.1An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not prop CVE-2021-420475.4An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users ca CVE-2021-420484.8An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer hom CVE-2021-420496.5An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages whe CVE-2021-420506.1An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.CVE-2021-420515.4An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document CVE-2021-420527.5IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and th CVE-2021-420535.4The Unicorn framework through 0.35.3 for Django allows XSS via component.name.CVE-2021-420547.5ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.CVE-2021-420556.8ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.CVE-2021-420566.7Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a loc CVE-2021-420577.8Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker