CVE-2021-31550: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. The vulnerability allows malicious actors to introduce XSS (Cross-Site Scripting) payloads into various layers through crafted configuration variables (CVE Database, MITRE CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 score is 3.5 (LOW) with vector (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE Database).

The vulnerability allows attackers to execute cross-site scripting attacks through configuration variables, potentially leading to unauthorized access to sensitive information and manipulation of web content. The impact is considered medium severity due to the requirement of user interaction and limited privileges needed for exploitation (CVE Database).

The vulnerability has been addressed in MediaWiki's CommentBox extension. Users should update to a version newer than 1.35.2 to mitigate this security risk (CVE Database).