BIT-mediawiki-2023-37251

2024-03-0611:01:00

Google

osv.dev

mediawiki

googleanalyticsmetrics

onclick handler

javascript

url

6.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

CPENameOperatorVersion
mediawikilt1.39.3

CPE	Name	Operator	Version
	mediawiki	lt	1.39.3

References

phabricator.wikimedia.org/T333980