CVE-2022-21710 - CVE House

Back to Database

Status published Medium CVE-2022-21710

Cross-site Scripting in ShortDescription extension

4.7 CVSS

Vulnerability Description

ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img src=x onerror=alert()>}}`. This issue has a patch in version 2.3.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-21710

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from StarCitizenTools

View All →

Citizen vulnerable to stored XSS in sticky header button messages

Citizen stored XSS vulnerability through short descriptions

Citizen Short Description stored XSS vulnerability through wikitext

Citizen is vulnerable to stored XSS attack in the legacy search bar

TabberNeue vulnerable to Stored XSS through wikitext

Affected Vendor

StarCitizenTools

View all reports →

Affected Software

mediawiki-extensions-ShortDescription

Vulnerable Versions:

< 2.3.4

Timeline

Official Publish: January 24th, 2022

Last Modified: April 22nd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement