Lucene search

GitHub Advisory DatabaseGHSA-FMRF-P77G-VV5C

HistoryJun 30, 2023 - 6:31 p.m.

MediaWiki Cross-site Scripting vulnerability

2023-06-3018:31:02

CWE-79

GitHub Advisory Database

github.com

mediawiki

cross-site scripting

sitelinksview.php

wikibase

xss

crafted badge title

lack of escaping

wbtemplate

resources/wikibase/templates.js

quotes

title attribute

software

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.2%

JSON

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

Affected configurations

Vulners

Node

wikibasewikibaseRange≤1.39.3

CPENameOperatorVersion
wikibase/wikibasele1.39.3

CPE	Name	Operator	Version
	wikibase/wikibase	le	1.39.3

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649

gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650

github.com/advisories/GHSA-fmrf-p77g-vv5c

nvd.nist.gov/vuln/detail/CVE-2023-37302

phabricator.wikimedia.org/T339111

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.2%

JSON

Related for GHSA-FMRF-P77G-VV5C