Sbassett

**Name of the Vulnerable Software and Affected Versions** Apache Archiva versions 2.0.0 and later **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This affects Apache Archiva, a product that is no longer supported by its maintainer. As a result, no fix is planned for this issue. Users are advised to find an alternative or restrict access to the instance to trusted users. An additional mitigation measure is to configure an HTTP proxy in front of the Archiva instance to filter out requests with malicious characters in the URL. **Recommendations** For Apache Archiva versions 2.0.0 and later, consider the following: - Find an alternative to Apache Archiva. - Restrict access to the instance to trusted users. - Configure an HTTP proxy in front of the Archiva instance to only forward requests that do not have malicious characters in the URL. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions prior to 1.35 MediaWiki versions prior to 1.34.0-rc.0 **Description** The issue allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. This is achieved by exploiting the `resources/src/mediawiki.page.ready/ready.js` file in MediaWiki. **Recommendations** For MediaWiki versions prior to 1.35, update to version 1.35 or later to resolve the issue. For MediaWiki versions prior to 1.34.0-rc.0, update to version 1.34.0-rc.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `resources/src/mediawiki.page.ready/ready.js` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MediaWiki MobileFrontend extension versions REL1 31 through REL1 33 **Description** The issue exists within the edit summary field of the watchlist feed, allowing for XSS. **Recommendations** For versions REL1 31 through REL1 33, update to a version that includes a fix for this issue.