CVE-2022-34911

An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().

• CWE-79

• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
• https://phabricator.wikimedia.org/T308471Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202305-24
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
• https://phabricator.wikimedia.org/T308471Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202305-24
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory

Published

Jul 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34906A hard-coded cryptographic key is used in FileWave before 14…7.5
• CVE-2022-34907An authentication bypass vulnerability exists in FileWave be…9.8
• CVE-2022-34908An issue was discovered in the A4N (Aremis 4 Nomad) applicat…7.5
• CVE-2022-34909An issue was discovered in the A4N (Aremis 4 Nomad) applicat…9.1
• CVE-2022-3491Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
• CVE-2022-34910An issue was discovered in the A4N (Aremis 4 Nomad) applicat…5.5
• CVE-2022-34912An issue was discovered in MediaWiki before 1.37.3 and 1.38.…6.1
• CVE-2022-34913md2roff 1.7 has a stack-based buffer overflow via a Markdown…9.8
• CVE-2022-34914Webswing before 22.1.3 allows X-Forwarded-For header injecti…9.8
• CVE-2022-34916Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to…9.8
• CVE-2022-34917A security vulnerability has been identified in Apache Kafka…7.5
• CVE-2022-34918An issue was discovered in the Linux kernel through 5.18.9. …7.8