Greetings-

With the security/maintenance release of MediaWiki 1.31.16/1.35.4/1.36.2 [0], we would also like to provide this supplementary announcement of MediaWiki extensions and skins with now-public Phabricator tasks, security patches and backports [1]:

== DataDump == + (T286376, CVE-2021-32774) - Potential CSRF generating dumps < https://github.com/miraheze/DataDump/commit/67a82b76e186925330b89ace9c5fd893...

== GlobalWatchlist == + (T286385, CVE-2021-42046) - XSS in GlobalWatchlist https://gerrit.wikimedia.org/r/q/Ib7f9b009730fe0df283cec1169f84c7a83a58b1d https://gerrit.wikimedia.org/r/q/Id2204fb5afe591d63764466de35ac0aaa5999983

== Translate == + (T286884, CVE-2021-42049) - Oversight action not reversible in translated page <https://gerrit.wikimedia.org/r/q/I4d95220ef414337147235f7ebedc9b945c3348e3

== GrowthExperiments == + (T289063, CVE-2021-42047) - Mentor dashboard: Permanent XSS exploitable by wiki admins < https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GrowthExperiments/+/72...

== GrowthExperiments == + (T289064, CVE-2021-42048) - Newcomer homepage Impact module: Permanent XSS exploitable by admins for new accounts <https://gerrit.wikimedia.org/r/q/Iaa90a8976834d70caad592e9d1b18510318db537

== SecurePoll == + (T289385, CVE-2021-42045) - Modified HTTP headers allow XSS https://gerrit.wikimedia.org/r/q/I4f04083cd00884d3b85245460774c81c7639a578

== Growth Experiments == + (T289408, CVE-2021-42044) - Permanent XSS exploitable by wiki admins (client-side part) https://gerrit.wikimedia.org/r/q/I858d55fb2eca9b50ac6ef5a6f2a7b2784f0fa0d6

== Growth Experiments == + (T290692, CVE-2021-42042) - Permanent XSS exploitable by wiki admins in SpecialEditGrowthConfig https://gerrit.wikimedia.org/r/q/Ibeb13d032ca044af53f6b2334e27b6b97b6f4e9f

== Loops == + (T287347, CVE-2021-42040) - Loops can cause php-fpm exhaustion https://gerrit.wikimedia.org/r/q/I0caf6f129f94612b5bcf406a171aa5ffedea1f80

== CentralAuth == + (T291696, CVE-2021-42041) - XSS vulnerability in the 'setchange' log https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35

== MediaSearch == + (T291600, CVE-2021-42043) - XSS on Special:MediaSearch https://gerrit.wikimedia.org/r/q/If64eb5842237c92290d07ebc3fe14710d9de3fc2

The Wikimedia Security Team recommends updating these extensions and/or skins to the current master branch or relevant, supported release branch [2] as soon as possible. Some of the referenced Phabricator tasks above _may_ still be private. Unfortunately, when security issues are reported, sometimes sensitive information is exposed and since Phabricator is historical, we cannot make these tasks public without exposing this sensitive information. If you have any additional questions or concerns regarding this update, please feel free to contact security@wikimedia.org or file a security task within Phabricator [3].

[0] https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimed... [1] https://phabricator.wikimedia.org/T285414 [2] https://www.mediawiki.org/wiki/Version_lifecycle [3] https://www.mediawiki.org/wiki/Reporting_security_bugs