Lucene search

GoogleOSV:BIT-MEDIAWIKI-2023-51704

HistoryMar 06, 2024 - 10:57 a.m.

BIT-mediawiki-2023-51704

2024-03-0610:57:11

Google

osv.dev

issue

mediawiki

xss

rightslogformatter.php

group-*-member messages

special:log/rights

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

CPENameOperatorVersion
mediawikilt1.35.14
mediawikige1.40.0
mediawikilt1.40.2
mediawikilt1.39.6
mediawikige1.36.0

Name	Operator	Version
mediawiki	lt	1.35.14
mediawiki	ge	1.40.0
mediawiki	lt	1.40.2
mediawiki	lt	1.39.6
mediawiki	ge	1.36.0

References

lists.debian.org/debian-lts-announce/2024/04/msg00018.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/

phabricator.wikimedia.org/T347726

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:BIT-MEDIAWIKI-2023-51704